Loz is about right. I gave up with the g/f's puta that her lads kept loading viruses onto. I locked it down, turned IE6 off, substituted Firefox for it instead, gave them restricted user rights etc. End of virus/malware problems until they complained about restrictions on sites and software they wanted to install so, she gave them the admin account details....
I don't bother sorting it out anymore...now they complain about a slow pc, pop-ups an long boot times...
Of course, to protect yourself you could put together a Smoothwall firewall, hide urself on the green interface and let them reside on the orange interface or DMZ....effectively letting them do what they want but keeping them locked out of your secure side of the LAN. At least your business machine will have some degree of safety. Make sure they don't have access to your shares otherwise their infected machine/s could open a whole can of worms re. your data security.