How do you educate your users on how to not infect their PCs with viruses, i.e. fake anti-virus?

I'm the sys admin for a small company and as such there are only two of us sys admins and we have to manage the servers, maintain the network, handle end users, etc.

I just had a user manage to get infected with the fake anti-virus program for the 2nd time in as many months.

Unfortunately, due to management, not giving the end users local admin rights, is not an option. I've told the end users if they ever see a popup that looks like a virus scan or whatever, not to click yes, no, accept, cancel, anything...only to kill the task immediately (with instructions on how to do so).

However, user education doesn't appear to have been enough. How do you guys handle end users who don't know how to keep their PC running safely on the internet???