The problem with using cleaning tools like the ones you mention is that I'm always left wondering, "What did I miss?" when they've finished. Since it's a long process that's always potentially incomplete, I abandoned that approach years ago. The first thing I ask a client is "What data do you want to keep?" Then I scan the drive offline (mostly for my own curiosity, but also to get an idea of what I'm dealing with), save the data, reinstall the OS from scratch, then restore the data (sometimes with additional scans). This is the only way I feel comfortable handing the computer back to the client.
I agree there's an element of wondering with the tools. Part of the reason I use a bunch is to remove as much as possible. Even on the fifth scan, there are still things found. That's the cutoff where, in my experience, subsequent scans by other tools just don't find things.
I second the `what do you want to keep` sentiment, too. The downside to this is having them effectively sign off on what they want, and then they forget something until 6 months down the line. I have provision for keeping a drive image of their drives for 28 days, with prior permission, and I check in with them after 7, 14 and 21 days to make sure all is well. The comfort of a familiar desktop is a powerful thing, and the Windows Easy Transfer process makes it easy and straightforward.
I would, and do, take the further step and repartition & reformat in DOS to eliminate rootkits. Have seen them carryover through new installs before, even after reformatting; TDSS I believe it was, but not 100%.
