Basic preventative measures such as keep everything patched, keep your AV definitions updated and be careful of what applications you allow your machine to run. I also found that a company named Trusteer Has a product to help fight MITB attacks. I haven't used it personally so I can't vouch for it yet. In the end once you have malware on your machine the only way to make sure it get's out of there is to reimage it.
EDIT: (to answer about what developers could do)
For authentication purposes the developer could implement some sort of 2 factor authentication such as google authenticator, require a certificate to be installed on the client machine or require a smart card to be inserted into the machine.
Google Authenticator is probably the easiest thing to do but the user still has to type in their auth code, the attacker will have less than a minute to use it so they would have to be sitting there waiting, it could also be written into an application to find the auth code field and use it.
Installing a certificate on the users machine would help however if their machine is compromised the attacker can get the cert and abuse it. It would also make it a pain for the customer to use other computers to access your site since they would need to install a cert on every computer they use and I guarantee at least one of them will install it on a public computer in a library or internet cafe.
Requiring they insert a smart card is good but unless I get REAL value from your site I'm not buying a smart card just to access it and good luck trying to convince your business people to buy a smart card for every customer.