virus issue

virus was detected from a flash that was placed into a friend's exchange server. the run command, the task manager and the view folder options were some of the most noticeable things that were eaten by the virus. a reinstallaing the service pack 1 for win 2k3 server was done. he doesn't want to have to backup and format the server, he has mcafee total protection 8.5i running as a standalone AD is also on this server. he wants to get the server back the way it was. pls what do u think he should do, cos i've tried convincing him 2 backup and reinstall the server.