A firewall is for blocking the incoming (and some of the outgoing ports) in the <A HREF="
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/c..." target="_new">TCP/IP</A> stack, to keep other users from accessing your system and taking control, or inserting nasty items like Trojans. It is also to keep programs from connecting to the Internet without your permission, such as applications that are spyware, or viruses, such as the type that infect an address book, and mail themselves out (hopefully with you being none the wiser.) Firewalls are about security.
Would a firewall help stop damaging applications from installing themselves? Yes ... but only if the security level permissions are set fairly high, based on the software I've seen.
Many companies who offer firewalls have also been adding popup banner control features for quite some time, such as Zone Alarm Pro. Even the third-party browser I prefer (Crazy Browser) has a customizable popup filter.
The best solution, IMHO, is a hardware firewall (such as through a router), with the addition of a software firewall, <i>and</i> a program dedicated to controlling java-based popup ads (many of which are more than just irritating ... they can install applications right through security holes in the OS or the browser. All it takes is one misplaced click ...)
If you've been seeing this kind of stuff at work, then I'd have to venture that whoever is managing the network is not doing their job right, and the security is lax. But there could be extenuating circumstances in a position like this, such as not being allowed to make extra purchases, due to budgetary constraints because of economic conditions. It's not unusual for the IT tech on the job to understand the need for higher security, but still not be able to adequately communicate the reasons this should be a high priority when the money just isn't there.
Or the tech might just be a slacker, working for an ASP who doesn't give a darn, or care if the systems go down. Some folks place too much confidence in backups, and if you lose your daily data ... so what? It's not <i>their</i> job to make sure you get your data ready for the tape. If you follow my meaning.
From the way you are talking, it sounds like the workstations are not even on a LAN, and perhaps one of the upper mucky-mucks would appreciate your contribution, if you can upgrade the security without spending tons of cash. I can't see how it would be a problem to be interested enough in your job to make a suggestion or two. At the very least, it should be brought to someone's attention, before an application crawls into a system ... causing massive spam attacks, or problems such as you've already experienced ... which could be the least of what could happen, in my experience.
If someone is amenable to your suggestion, I'd recommend looking around for firewalls and programs that can be bought/licensed in bulk, to save money, and for easier deployment.
Toey
<A HREF="
http://forums.btvillarin.com/index.php?act=ST&f=41&t=32..." target="_new"><font color=green>My System Rigs</font color=green></A>
___________________________________________
<A HREF="
http://forums.btvillarin.com/" target="_new"><b><font color=purple>BTVILLARIN.com</font color=purple></b></A> - <i><font color=orange>Your Computer Questions Answered</font color=orange></i>