Alex - that thin client looks good to me. I would opt for the one with 2 Gigs of RAM instead of 1. Running the gateway all the time shouldn’t cause much strain on the thin client. Your architecture resembles the emergency model. For your situation, I would keep the local (panel) projects simple so that you don’t have to keep updating the project on every station with every minor change.
Dennis - that worm looks pretty specific to Siemens S7 products running on Windows. Could you describe what happened on your network?