Situation: Spybot-S&D removes malware it has found.

Experienced: there is malware that is re-downloading missing parts, with multiple parts re-installing each other.

Expected: close Internet connection while fixing malware..

I agree that this should be implemented, however, i would like to see a pop up box informing the user why this action is being taken and if they want to proceed, in case they are downloading something, etc. Also, would it disable all network devices to shut the Internet off? And then re-enable them on the next system startup? How exactly will this work? Just wondering. :)

There should be a warning that Spybot is closing Internet connection.

I like the sound of this but there would need to be a warning that Spybot is closing the connection and have Spybot re-enable it after the Malware has been removed. Another possibility is to have Spybot create a System restore point before cleaning commences just in case it goes pear shaped.

Yes, this of course need a warning/user confirmation. Probably another flag to enable that only when specific malware results were found to not have to use it all the time.

What we've played around with is the IP filtering interface that was introduced in Windows 2000. It would allow to apply a block-all filter (maybe plus a few small rules to allow Spybot updates) to network interfaces while fixing takes place. That filter could be removed once the fixing is done (or if a reboot is necessary, not before then).

System restore points are already in the options in 1.6, will write me a note to make sure they're not forgotten in 2.0 either.