Users that always run with admin rights AND don't know what they're doing
is the problem.
Windows is the only current OS where this attitude is prevalent. There
should be no need to ever run as an administrator unless you are performing
administrative tasks. Do you know every process that is running on your
computer and what it is doing at every second you are using the computer? I
see many computers where the owner "knew what they were doing" that are
infected with malware. They have an up to date AV installed and often
antispyware as well. If they had not been running as an administrator the
malware would only have infected one account and would be simple to remove.
Because they were running as an administrator the malware has to be manually
removed while booted from a Linux CD. If you routinely run as an
administrator the only reason you haven't been infected so far is because
you are lucky. The malware authors are always ahead of the anti-malware
authors.