In the thread titledHow to disable downloading on employee's computer?, mrjimphelps says
I would find the person in the company who rarely if ever gets infected, and I would let that person, and that person only, do the downloading.
I'm bringing this up because I strongly suspect that this misses the point. I feel that many people who are always getting infected by stuff may not realize that they are doing something wrong. I think this is probably an education problem. I suspect that if you were to sit down with someone who seems to habitually download junk, you'd find that they are merely the type of person that malware and junk authors target -- someone who thinks that "You are infected! Click here to clean" is a sincere message, and that the spam download link is the one they should click, not the real one below.