As long as you've not managed to get your system partition infected, yes, a reset will remove any malware. And these days it's virtually impossible for malware to install to /system unless you have rooted the phone first (because if you have the ability to give administrator privileges to an app then any malware you install can potentially use that).
I say "any malware you install" because as
@ocnbrze has noted there is no self-propagating malware (viruses) for Android, and so the primary source of malware infection is unwitting users installing infected apps. Hence being careful what you install and where you install from is the best protection against infection.
One thing you should consider though: you do know the current Google password for the phone before you format it? I'd think that people would, but occasionally we get people here who don't remember their own password (or, if you've just bought the phone second hand and the previous owner didn't properly remove the account first). The problem is that if there is currently a Google account on the phone and you do a reset you will need to enter that account's password after the reset before you can use the phone: this is an anti-theft measure called "factory reset protection", designed to render the phone useless if a thief resets it to prevent it being traced and allow them to sell it. But if you don't know the password it will do the same to you, unless you remove the account first.
