If we're talking about "crapware" that a "client" might send, I would say the best way is to be prepared to restore.
How to verify
It can be done in many ways but **bleep** happens so we need to prepare.
We still need to be careful and stay updated though, because on cases like this (and many others) a restore might be too late. No simple verification method or 'antiviruses' can act as a fool-proof method to prevent those, and being prepared to restore will at least make some part of the 'incident response' simpler.
