Enterprise environments don't really "clean" machines, they just get re-imaged.  Which is why most enterprise security efforts are focused on automated interdiction, and IDS/IPS.  It's far more appropriate to detect that a machine is compromise and then automatically remove it from the network for kick it into a VLAN that's not trusted.

At the last places I was working, we'd attempt cleanup, but if it was truly borked up, we'd reimage.  The workstations would have enterprise versions of Symantec or McAfee, otherwise any viral or malware detection would be done by observing network traffic.

Anti-malware products suffer the same problems AV programs do, in that they don't detect everything.  Once a machine is observed exhibiting abnormal traffic, it's either moved to a separate vlan as Enigma stated, or the port is shut off.  From there we would install a couple of anti-malware programs after the fact and attempt to clean it.

This.

Why spend an hour and a half running scans when the PC can be replaced with one that has a fresh image in under 30 minutes.

Intrusion protection system blocks a lot of shit before it can do damage.  I use Sonicwall.