This is definitely about heuristic spyware detection. The concept of detecting spyware without a signature is "heuristic."


Quite frankly, I believe that internet connections should be suspended if users cannot prevent their machines from being zombied.

In an 'Ideal" world, all OS's would come preconfigured to not be exploitable
No off the shelf OS is preconfigured to be unexploitable. Even Debian allowed for exploits. Not all of them were remote, but it was exploitable nonetheless.