Do you want it so your bro can still use your computer but just not download and install stuff? OR do you want total control and not allow him in? If you want him to still use it, you can set him up a new account with limit access, which means he can still download stuff but just not install anything. Its very hard to block the total control of downloads from the net. You could install zone alarm and set it to high control and have a password which makes him enter in the password if he wants to download something (he doesnt have pw, you do). you could even change some setting in Services, but thats alittle crazy.
(")_(") Control your computer, Dont let it control You!