Hm, on second thought I don't think my reasoning is very good. Anything the user deliberately installed was probably installed by logging in as Administrator, which would give the software the power to subvert firewalls. :(

> That would be good, but loads of the newer trojans can get round personal firewalls, I'd think that would be true for only poorly written firewalls. Any decent firewall should refuse passage to processes running as the normal (limited) user, at least without querying interactively the logged in user. Of course, if the user is silly enough to be running as Administrator, then they're opening themselves up to trojans anyway, right?