I see stuff get through on restricted accounts all the time where I work. They most likely use various IE exploits that allow to run right as admin anyway. Windows user "security" is actually a big joke. It's too easy to bypass. Boot up with Linux on a windows machine, you can access the ENTIRE disk. What do you think these viruses do? Instead of checking against NTFS permissions to access the disk, they just bypass all that and access the disk directly, just like what happens with a linux boot CD.
While patches help, the way I see it is if the virus made it up to the point where the patch is what stops it, then that's a problem on it's own. It should not even make it that far.
If I was fully in charge of IT for a company I'd ban the use of IE, and force firefox, or maybe even a less popular browser like chrome. Then force all web apps to work on that browser. None of this outsourced crap that only works in IE. I'd get real programmers.
Then I'd also have all http traffic forced through a special proxy that removes any potential malicious javascript, blocks bad sites etc... The key is blocking this stuff at the gateway as much as possible. Firefox and even chrome could potentially have exploits but they'll have way less then IE, so while it helps, it wont fix the problem on it's own.
And obviously, AV on each PC helps too.
One of our customers has the most inconsistent network I've ever seen. Some PCs have nod32, some don't, some have AVG, some have norton, it's a mess. They get viruses all the time. I've actually come to the conclusion that medical workers including doctors are very retarded when it comes to computers, but nobody, beats teachers at stupidity. teachers are the worse ever. They simply have zero clue about computers. It's sad really.