The whole problem is that nobody knows for sure. If you've got a possibly-malevolent possibly-exploitable third party agent with wide access to the system, it's not really your personal computer any more, is it?