As for virgin clean PC's, I used to (and still do) use something called Deep Freeze, reboot to restore thing. If the host computer it's installed on gets infected, before it can propagate any problems to the rest of the network (assuming you disconnected it physically from the rest of the network), you just reboot, and it's back as new, as if it was never updated.
Does your reboot re-flash the BIOS with a known-good image? Probably not. Even if so, what ensures that supposedly known-good image has not itself been corrupted by the malware?
Again. There is NO perfect security.