colr: I haven't tried this myself on a web server, but I have on intranet servers and it works very well.
Have you looked up
Symantec Anti-Virus, Corporate Edition yet? It's easy to configure and it blocks about 98% of stuff from getting in.
Symantec's Gateway Solution may be what you're after as well, although I haven't tried it.
Buuuuuuuuut...ultimately, would it not make more sense for your clients to have their own AV solutions? After all, this will only protect your web server, and if they download emails and visit other websites not hosted on your server, they're subject to all sorts of other nasties that you can't control.