There are a limited number of ways spyware can a) infect your machine (downloading an active x control - gator/any dialer program or having it bundeled with another application - like Kazaa or LimeWire) and/or b) how/where/when the application is run from. There are specific, well known spots in the registry for BHOs, startup files, services, etc. The logical thing, IM very HO, would be to change how applications can access those areas. Programs like TeaTimer watch those areas and flip out when an app tries to access them. Getting infected, and then running a tool, over and over and over again, seems ridiculous. Why manually run an app when the holes that allow infection are what really need to be focused on?

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/289/29832#29832