or vulnerable version of IE (u can just get ur machine compromised by surfing..how fun)
that was how the source code of halflife got stolen i believe
yea.. even if ur firewall is set to disallow all outgoing connection ..but only allow incoming connection to vulnerable version of IIS ... it'll still be possible to allow complete control of the server (one way shellcode)