Blocking the use of UltraSurf in a controlled web filtered environment

We are having issues with users using Ultrasurf to circumvent the web filter and access restricted sites. We have had limited success by blacklisting the IP ranges associated with Ultrasurf and preventing access to alternative DNS servers. Is there a better solution? We would even be willing to pay for a solution.