Hypothetically let's say I have reason to believe my operating system is compromised with spyware, and there's no way to remove or disable it. But I have an advantage insofar that I know the IP addresses the spyware is sending my info to, so I can mitigate the damage by using my router's firewall.
But then I want to take the computer traveling, which means it won't be under my external firewall whenever I connect to WiFi abroad and what not. Is there a way to virtualize a hardware firewall so that I can be confident that the spyware's TCP/IP packets are nullified? (I can't just install a software firewall within the OS because I don't know if the spyware would have some way of compromising it; say, via a rootkit or something similar.)
I guess the hypothetical was too specific, so I'll try to be more clear. I'm looking for a way to nullify (with certainty) TCP/IP packets being transmitted from an OS that may be compromised. So one way to do that is to use an external firewall like a router, but suppose you can't use that because you're traveling. The only solution I can think of is to put the entire OS in a virtual machine and then use the host OS's firewall, but is there any other possible solutions?