Most of my clients are experts in everything BUT computers. So I just tell them to take the box to their computer tech and get it cleaned, figuring a tech SHOULD know what to look for once he's told the box has been owned by hackers, or at least that is the theory.
I've also suggested that if their current AV didn't catch this problem they've had, it's probably not a very good AV. I've been recommending Kaspersky AV/Firewall combo, since it's been fairly bulletproof for me (***knock on wood***).