We had a similar situation. One user had Kazaa and downloaded a 'spy bot' disguised as an MP3 file.