This also a good time to bring up the point of the value of having a "system image"
Never trust a machine that has been compromised ....
If you get "had", play it safe, reload your system from a known good system image and learn from your mistake.
You really can't be 100% positive of any "cleanup" efforts.
Backup, Backup, Backup