Quote:
There must be MILLIONS of infected computers out there that people just deal with.

There ARE millions of infected comps out there, if the numbers reported by botnet researchers can be trusted (100k to 400k compromised in a botnet, typically).

Here's how people deal with it:
Home User: "My 6 month old computer is really slow. Must be time for a new one."
Computer Store Guy: "Your gigaflops and megajerks aren't good enough. Buy THIS one (with a 6 year extended warranty)."

Seriously though, there MUST be silver bullet to stop spyware from coming in. This spyware preventing software must be doing things that we can do ourselves. If I had a second life time, I would figure this out myself.

Some hypothesis:
Use Local or Group Policy to force AutoUpdates to download and patch every night, setting missed patchings to run at next login (with no ability to stop forced reboot? is that an option, i forget.)
In the registry, deny every user and system account write/modify permissions to the typical startup keys and spyware hiding places (even services?).
In the registry, deny all permissions to IE security (and other) settings so they can't get hijacked.
Deny every user and system account write/modify permissions to startup folders.
Write protect the host file and maybe even the local DNS cache....?

These are pretty restrictive. ie: you can't install or change anything while they're in place. So, write software that's a "switch", turning these features off for a few minutes (forcing the security back on after that time) when you need to install something or apply patches (so it'd need to play nice with AutoUpdates?).

So it's a pipe dream, but maybe not. There must be an elegant solution to stopping spyware; one that can be simplified to a "push this button to allow system modification" for every user on the internet. Maybe I should quit my life and create this.

Unfortunatly, social engineering can crush this instantly. One e-mail saying "Helo, pres unsecure button than clik attach picture. Its fun! Thanking you." and thousands of untrained users will get nailed. That's where heavy handed ISPs are needed. There must be a way for them to to block ports to all residential users unless they complete a simple online request. At least, couldn't they somehow deny SMTP outgoing (and secure variants) to block compromised spam sending machines? But... hm... then desktop e-mail clients couldn't send to their local servers... Regardless, it would require costly heavy hardware and would turn users away.

Alas, the only solution is, and always will be, cutting our collective ethernet cables.
_________________________
-
FireFox31
110gig MKIIa (30+80), Eutronix lights, 32 meg stacked RAM, Filener orange gel lens, Greenlights Lit Buttons green set