Also on Windows, consider looking at Software Restriction Policies. For my host partition, I have things configured to deny execute for anything not in Windows (and excluding some temp/cache dirs). So if I step away for a minute and someone tries to download and run an exe, Windows should prevent it. Would also prevent me from drunkenly saving cute.jpg.exe to my desktop and running it.