Sounds like a "hole" in the "rights" for user accounts.

Well, the hole is that Firefox does not use a Windows installer. So the installation is accomplished by another means or it would be blocked. What does it use to load? Is it an executable? If so, what is the name of the executable? I need to block this installation.

Users can always use a portable Firefox version installed on an USB stick.

If you do not want users to have access to internet then you need to block that via a firewall or special proxy.

You can always rename files to circumvent measure that only look at file names.

• http://releases.mozilla.org/pub/mozilla.org/firefox/releases/latest/