You can ask two questions in one, but you might get only one answer. I'll try to answer both of yours, since they are kind of related.
Almost all of the computer viruses out there "on the net" today work by putting files on your computer. Sometimes they will "infect" an existing file, by hiding the virus code inside it. Other times they will try to hide themselves by using common file names, or by putting the files in normally hidden directories. For all of these kinds of viruses, wiping the hard-drive completely clean will get rid of them.
But you have to be thorough in wiping the hard drive. A "quick" format won't do the trick all the time. A quick format doesn't actually wipe the drive, it just resets the drive to be empty. Virus code could still be hiding in deleted files. If you've ever seen an "undelete" utility, then you know that just because the file is deleted doesn't mean it's completely gone. Even if you do a full format, you have to be sure to write over the "boot block" on the disk. This is the area of the disk that holds the partition information and the little program that loads up the OS. Some viruses like hide there because then they can get control of the computer every time it boots up. So if you are worried about really nasty viruses, use the most complete format option.
I'm not going to tell you about "firmware" viruses, because a) paranoia is contagious enought, and b) there haven't been any successful examples to date.
As far as XP vs Vista: A pentium III processor is probably not powerful enough to run Vista. You might be able to run Vista home basic, depending on how much memory you have in the computer. But for even mildly intense applications (basically, anything besides email) you are going to need a much more powerful processor. Most vendors recommend at lead a dual-core system with 1-2GB of RAM. Hard drive space is not critical, but 40G might be on the small side. There's no reason to be crowded when disk space is so cheap.
Note that many people are in the same situation as you are: they have a computer that runs XP perfectly fine, but isn't enough for Vista. Why upgrade to another OS that does basically the same thing, especially when it costs more AND you pretty much have to buy a new computer to run it? If you are worried about XP being to old (or too prone to viruses), then maybe you should take a look at Linux or OpenSolaris as alternatives.
