You could start by blocking with dns-service. What they download is probably not covered by OpenDNS so use DynDns
http://www.dyndns.com/services/dynguide/ Has the advantage over similar services that you can whitelist/blacklist domains. Set dns service up in router if possible. OpenDNS is way more slick and probably better with parental control but they save "malware" protection for those with too much money to spend. If you need safe mode and antimalware programs to clean up Opendns will not be enough.
Norton has dns-service
http://nortondns.com/ and toolbar protection, Safe Web Lite
http://safeweb.norton.com/Also WOT
http://www.mywot.com/ will block many unfortunate downloads. Set it up so only RED sites are affected. No warnings, chose block. That way less FPs. They can ignore WOT of course but then they want trouble
WOT can insert colored lamps in Google searches and elsewhere - you can turn all that off. Can be as transparent as dns blocking.
Microsoft also have Live Family Safety
http://explore.live....s-live-family-safety Don't know how well it filters but obviously more direct control or spying.
Not sure of impact on XP but they should have course not be logged in as Admin. Limited users for them.
Also a good idea to remove ads, probably what they click on to get toolbars. If IE is main browser try Simple Adblock
http://simple-adblock.com/ works just as good as Adblock on Firefox.