>That's why it's only my second option. Even so, at least under linux you can have a real firewall. The last one which worked properly under windowses was something called SysGate or some such silly name, which was then bought by Symantec and defanged into ZoneAlarm (so it never got built for 64bit... the 32-bit version should still work). Any other firewall after that either considered ALL outgoing traffic as regular, or at least anything coming out of registered software (like windowses themselves) and it was either impossible or very very hard to set up to stop such things leaving your box. I still have a screenshot of how any run of a .msi file calls a server in Redmond. Every one of them, even those you have built yourself, using Wise or some such tool.

One of the reasons I move much of my stuff to disconnected net of machines. Connecting only needs to plug in uplink of router or plugin physical machine into other router - done only if USB transfer is not possible, backup is recent. Paranoids have enemies too...