Ended up definitely being an issue with the 3 stage virus scan that GFI WebMon does (BitDefender, Kaspersky, Norman). Tried just using one of them in turn, same issue. Ended up turning it off, downloads work fine.
Obviously it'd be nice to have this extra level of protection, but it's causing too much hassle atm and stopping people doing their jobs (or rather helping them do it even slower).
Thanks for everyone's help.