There's also the particularly sneaky method of hiding malware scripts in RAM. The script lives there & gets kept alive by the CMOS power. The result is that after you've cleaned, reinstalled, replaced, re-everythinged, you fire up your fresh new machine with the same old virus on board.
Which can be confusing as well as enormously frustrating.
It's not that often you'll see this method, but to make sure the infection isn't resident in RAM, disconnect the 240v power supply then remove the RAM sticks. Press & hold the power button to remove any last vestiges of power, then reinstall your RAM & reconnect the power.
You may never come across a RAM-resident virus, but the extra 2 minutes taken to ensure you've removed that possibility is time well-invested.