Why, if this is all above board, is it so hard to remove?

My sister came over yesterday for a Memorial Day weekend barbecue. Unfortunately, we weren't able to spend a whole lot of time together. Her PC got infected with spyware/adware recently and she brought it along to see if I could eradicate it for her.

She had one spyware removal program which identified several packages installed on her machine and supposedly removed them. Next reboot, they were back. I downloaded another spyware removal tool and went through the same process again. Next reboot, they were all back.

I set her Norton firewall to its strictest settings and rebooted the machine. It didn't appear to be stopping anything before that. At this point, armed with a list of program names that were attempting to access the internet, we searched disk and registry for any references to those programs and removed them. By the time she left, I think we had removed enough so they weren't activating at boot time anymore. I'm sure there are still traces that remain.

The removal tools may find all traces of the programs but fail to find the installer programs. There's so much cruft in the Windows registry that it's very hard to tell what belongs and what doesn't. Tracing what runs at Windows startup and login is next to impossible. There are so many places for these things to hide to avoid detection.

I tried to make her a bit more paranoid about what she'll allow on her computer and told her a few things she could do to research things she might like to install. I'm still worried that she'll contract something else due to the sleazy way they attach to innocent sounding things or even real legitimate programs.

So my sister was at my house for about 7 hours and out of that we might have spent 2 away from her computer. As far as I'm concerned, whoever writes or distributes these things is guilty of everything a virus or worm writer could be charged with. There's absolutely no legitimate purpose for these things.