I note from http://news.bbc.co.uk/1/hi/technology/4630910.stm that PC Viruses have been around for 20 years. Apparently, Brain appeared 20 years ago this month!
The first thing that struck me was that clients who have proper antivirus measures in place seem to be rarely affected by viruses. In fact, clients that have followed our advice to the letter have not had any problems at all. That is not to say they won't, but clearly that our advice does greatly reduce the risk.
Part of our advice is to ensure that client staff understand that they are part of the solution and need to be aware of the risks. We normally suggest that someone is responsible for checking with staff that their anti-virus software is up-to-date each Friday afternoon.
This may seem like an unneccesary step given how automated anti-virus systems are, but software is not infallible, so it is still worth checking! More importantly though, it makes people feel part of the solution because of their involvement in the process.
Certainly, from my own experience, several sites have been saved from potential nightmares by alert staff who have spotted something odd and brought it to the attention of their IT team.