Would you happen to be running as an administrator? If so, then you deserve the spyware.

A way to keep up to date on spyware is to follow the Spyware Warrior blog: http://www.netrn.net/spywareblog/

Anyone remotely technical has to stop running as Administrator. It's bearable if you have tools like Aaron Margosis' makemeadmin batch file and his PrivBar which tells you what context you're running IE or Explorer under. Couple that with using Run As with Internet Explorer on the few occasions you need a new ActiveX control, to edit a restricted file, or to use certain Control Panel applets, and it's not too bad - I've been set up like this at work and at home for a couple of months now.

Alternatively, if you can't bear that, you could use Michael Howard's latest MSDN article (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncode/html/secure11152004.asp) to drop your rights when running certain risky applications - your web browser, email client, news aggregator, etc.

You may wish to also run Spybot Search & Destroy. It routinely finds things that Ad Aware doesn't, and visa versa.

Actually I did run Spybot also! Based on the same advice you gave me.

I admit I am guilty of running as admin. I keep meaning to stop (at home and at work). I think Microsoft should start a real campaign to get employees to stop running as admin. I suggested this to Michael Howard -- we could have t-shirts with slogans like "Friends don't let friends run as administrator". He agreed it was a good idea, but nothing has come of it.

- adam

SInce Microsoft runs such a managed network environment I'm surprised you are allowed to run as Administrator there unless you absolutely have to for your development work. Is that a privilege that comes with seniority or does everyone through development sales and marketing routinely run as admin? Or is it just on your personal test machines? Do you have systems set up to filter spyware at the firewall?

I found 4 pieces of spyware on my machine at home. And I run in a LUA. And I have up-to-date AV, and I don't go to the sites that are likely to have spyware on them.

And I don't accept ActiveX controls, etc.

I don't know what vector they're using to reinfect my machine, but...