It seems that every few months I have the “I know it’s clean” conversation. Most of the time it is not easy to convince the stake holders in the taking the machine offline and rebuilding vs attempting to clean debate.
Cleaning the machines can work, but it’s not 100% and it takes time. Rebuilding can take more time, and if done from known good sources you won’t have any doubts about the status of the machine.
The Internet Storm Center has a two part blog posting with some great information on this subject.