8. The method of claim 7 further comprising: detecting a malicious file; adding the malicious file to a removal group; determining if the malicious file is part of the group; and adding the all files in the group to the removal group.
7. The method of claim 5 further comprising: finding the suspect term in the EULA; detecting all files being installed; and maintaining state information indicating that the all files being installed are a group and if removed must be removed together.