A lot depends what their need is. Some people want to have a system analysed and damage or exfiltration assessed. Others just want Windows working and My Documents back again (my dad's like that!). If there was malware, then, is the route it came in known, and its extent known (and was anything else piggybacked) which takes time but may be essential. On the other hand, perhaps their "virus" was an intermittently faulty DRAM module or a borderline failing HDD?
The upshot is, I would also consider things suited to getting the user up and running again as fast as possible on a clean system:
* Fast reputable verified file copier such as FastCopy if PE is used, to be sure you can back up their data and know it's reliable - as the state of their disks will be an unknown.
* Fast and reputable disk imaging program. Ideally one well suited to borderline-failing drives which may need repeat read attempts, in case a borderline failing disk is the "virus". Also if there is a genuine virus an image is crucial for many reasons.
* A Windows Updates offline installer and its current updates (Portable Updates, AutoPatcher, and a dozen others) to get them updated and patched without network reliance (router or local DNS etc could be targeted) or slow/poor cellular connection
* Repair utilities for common apps, in case of corrupt data
* Stress testing kit to check major components and platform stability
* Replacement parts for a few more common faulty components (spare DRAM module, ssd/hdd/cables they can have for a few days, or for me to take images of their disks on, and screwdrivers!)
A different take on it, but I figure I can always do more detailed work back home, via an image or their original (offline) disk, and have all my stuff there, do offline A/V scans to determine if there did seem to be a problem. A lot of the time the actual priority when people not in a big company ask for help on a "virus" or other major issue, is "can I get back to my stuff and how long will it take", and they may assume malware when it's hardware. A security/data recovery professional with more serious cases and larger clients, will probably prioritise assessment of infiltration and extent, a completely different focus.
