Setup proper user isolation. A "regular" user doesn't need the ability to install software or alter system files. When users run their entire system as "admin" (or root!) the virii they download has admin permissions to mess with user files. Running a virus as a restricted user who does NOT have premission to alter system files does very little damage.