The person who downloaded a required set of drivers might not had gotten it from a safe download site or, said that is when and where it happened but actually it had came in from a totally different venue.
Surfing to find what was needed at the time could had caused the infection from a bad java script to clicking on an ad;
If something needs to be downloaded you can save to desktop and scan it out before completely installing it to ensure safety.