Im gonna try to convince him to use the M$ patches... if not, the box (before i got my hands on it) had nothing on it that has todo with security. I installed adaware on it, and found over 400 nasty things crawling in it, and no firewall or nothing, not even an AV. Now i put adaware, symantec security suite, and spybot on it and after alot of scans and deleting and reboots, the system now looks clean. I also configured the firewall as best as i could. All scans now show a positive result. So far the sasser has not re-surfaced on that box. Hopefully it will be enough for the time being. The hard part is (as with most customers) to convince them to actually use the update buttons located on all these sweet tools to keep it all upto date.
Cheers for your help everyone