A properly configured firewall can also prevent a lot (not all) of the attachments from spreading in the first place. At work, we run Outlook w/ Exchange, and the Watchguard box will stop any attachments of various extensions (.vbs, .exe, .com, .scr, to name a few)