I haven't done help desk work since I was in college. I would guess the attack vectors are the same since then. Stupidity (clicking a fake system dialogue, etc. user intentionally did x but didn't realize that it was), JavaScript exploits (drive by downloads, etc), and maybe less commonly torrented or downloaded content containing malware. 1 and 2 are hard to distinguish once infected and are only really caught off your checking history or DNS queries. 3 has the benefit of occasionally being caught by another system before the user gets a bad download.