Hi,
I have setup small neotwork of 25 machines in our office...
I have done following things to stop users from downloading virus or spyware files..
1. blocked download of exe,msi files
2. virus check of all the mails on mail server
3. allowed only certain files as mail attachments
4. I have blocked all the ports except some standard ones like 21,80,22...
infact our firewall does support scanning of web pages for virus also but i have disabled this feature for the time being...
I think if you are on Windows server then I would suggest using
Kerio Winroute Firewall and applying rules..and for mails
MDaemon is very good
you can even setup Active Directory and block access to running unknown files on user machines using Group Policies...
for linux machine
Squid or
Safe Squid (very impressive) and for mail server
qmail or
sendmail....
Regards
Deep