working in the public sector, my workstations (25) are exposed to all kinds of malware. The only solution that I've found works is "DeepFreeze" enterprise version. No matter what the client users do on our system, thier activities and files are tossed out when they are logged off, leaving the pc's os and files pristine and malware free.