The best way to deal with this is via your companies terms and conditions of employment.
Bringing in illegal software should be categorised as gross misconduct, and these individuals should given a written warning or dismissed - that will deter this type of activity.

Other than that, probably the easiest check you can make is to poll the process list every 5 or 10 minutes and look to see if the program is running.

You might be able to use the file system object (fso) to get alerts when a file is opened, but to be honest the anti-virus products already slow things down enough.