You don’t “clean malware”. You level the machines and start over. Anything less is a disservice to your Customer and asking for trouble.
As far as dealing with the “threat”, you don’t allow users to run with Administrator-level accounts (on Windows), and you don’t install untrusted software (inasmuch as is possible). It seems fairly simple to me. My Customers and I do not have a problem with malicious software.