As a thought you could block access outgoing to all high ports >1024. This will cause some problems with other applications but you can allow those on a case by case basis. We only allow certain ports. It doesn't make our Realplayer and AOL Instant Messenger junkies happy but the price you pay.