I only do contract work, so I do whatever my Customers tell me to or, if I really don't like it, I exercise the "bailout clause" in my contract.
With that in mind, most people have had some kind of "malware" experience today. I discuss with the Customer how malicious software that they run via browser bugs, etc, has all the same rights nad privileges as the user account they're logged-on with (including access to their email and their keystrokes, not to mention resources on servers).
Normally I get a question like "Why won't the anti-virus software take care of it?" We then have the "arms race" talk-- the one about how the malware people are downloading the same updates to anti-malware software that you are and engineering around the new "signatures", etc.
I top it all of by explaining that I use limited user accounts on all my computers (and have done so for years).
This is all it has taken me to convince users to run with limited-user accounts. In a few occasions I've had to let the user have a malware experience first (which invariably happens), but since my services typically come with a very clear indication of the related expense attached, it usually only happens once.
I generally create "Administrator"-level users as either local accounts or domain accounts (along with restricted groups policy to actually give the user account "rights"), depending on how many computers the user needs the access to. I make sure not to name it in any of the groups used by the day-to-day user account, and not to give it access to their Exchange mailbox. I want the "Administrator" level account to be as useless as possible for anything except installing software / drivers on their PC.
This strategy has saved me a lot of headaches and has saved my Customers a substantial amount of money. It takes "people skills" to have the conversations you need to have, and being a contractor certainly helps matters, but it's definitely a surmountable problem.