We are always getting those stupid fake alert programs running on machines, and symantec never stops them or removes them.
I guess that unless they are well known, not much will stop scareware, as it doesn't seem to actually do anything malicious?

I would respectfully suggest that you take a look at your user account policies; as they shouldn't really be able to install anything executable?

Have you considered sandboxing your internet connections with something like sandboxie or fortres grand?