Not my idea of fun
Kaspersky hints at the "nuke from orbit" procedure needed to get rid of its recent infection by an in-memory Duqu 2.0 APT on page 33 of this exhaustive report. Basically
1) Identify Internet gateway and install hosts used by infection.
2) Simulate power outage — cut power to everything simultaneously.
3) Isolate gateways and install hosts from Internet and internal network.
4) Bring up gateways and install hosts, disinfect and harden them.
5) Give gateways and install hosts access to each other and Internet and observe beadily.
6) When safe, bring everything else back up. Well, before doing that you might want take steps to harden everything else too, but, without the gateways to act as first-level installers, this particular infection can't reestablish itself. Until the authors start to use a different day-zero to get in.
Glad I'm not in this particular game.