At my office I find us constantly fighting with malware. All users run under the "user" level, we have McAfee and have recently reviewed the Best Practices guide to ensure we adhere to it, all of my systems are patched with WSUS, and we regularly push FireFox and Flash updates via GPO.
Despite all of these measures, I still find users getting Malware on their PC's. For the most part this Malware is just "Scareware" however it looks as though it's put there from a dropper of some sort. While the Scareware is cleaned easily enough, I'm more concerned about the dropper putting a Trojan or Rootkit on a machine and that machine sending information offsite that it shouldn't be allowed to do.
My question is if we can't completely mitigate the infection of PC's, can we at least prevent that machine from connecting to the outside world? Firewalls will only go so far as they're stateful and will maintain a communication with external computers so long as they're the one that initiated the communication. Can this communication be effectively prevented?