[isostatic]

You have a corporate network which has SMB everywhere (as it's windows based). You have 1 of your 10,000 users run "funnyscreensaver.exe", and before you know it you're entire network is infected -- doesn't matter that your firewall blocks incoming or outgoing 137/139/445 - or even if it's an isolated network without even nat capability.