From what I understand, many “rootkits” as they appear on Windows attach themselves and then clear their existence from the list of running process information so they aren’t viewable, but are still queued in the task scheduler for execution. Why doesn’t Windows check the list of running process data against the processes/threads set for execution periodically and throw errors when a queued task has no associated process information?

I know very little about how Windows handles these things, but from what I’ve read about how a rootkit hides itself from things like Task Manager et al, this would effectively make the rootkit very noisy unless it relied explicitly on hooking into the kernel or something.

Of course, it also would lead to cybervigilanteism would companies would destroy end user systems.

Likewise people do purchase software/music/etc that goes in their computers, and many end users/customers would never know what they installed is actually doing to their computers. So yes a law to ensure that the customer is protect from Malware/DRM is needed.