so you picked my 2nd suggestion :) I think it is better to prevent installations, it will save troubles in the future
by the way, I use GFI WebMonitor to block all .exe. this is one step earlier - they can't even download the file unless I specifically allow it
