Another take to be done here is: computers shouldn't have unfiltered internet access all the time.
Whitelist it and once every 3 days open the internet gates.
(Easier said than done)