It's amazing that amount "crap" that various applications pre-install (think auto update programs for instance) that I would have never realized (thereby wouldn't have known to remove/delete those extra apps) without an interactive "personal firewall".
Might sound a bit harsh, but: Use your brain. A "personal firewall" is not
meant to replace your own thinking. If you don't know what an application actually installs, use snapshots of your system. If you don't want
to, I can't see your actual problem with that.
Oh: ESS is not made for malware detection, it features a virus scanner, not a "potentially unwanted software" scanner.
I am not sure how your average user is suppose to know the mind of an author/programmer that is devious in hiding unwanted processes/applications on startup/installation.
What seems to a common trend now is for installations to tack on various toolbars and spyware apps. Even a few of the trusted applications that I use, the newer versions now bundle junk with it, so you have to babysit the damn install and uncheck the junk.
An interactive personal firewall is useful as a first line of defense, it can alert the user that some app wanting out.
ESS like many other antivirus (started off as) programs are now trying to throw in the kitchen sink with their program so they try to be a jack of all trades in that area but are not always successful in every field.