http://searchsecurity.techtarget.com...thought-#Vista
yeah, apparently a little activeX and .Net content can be used to put almost any code you want right past Vista security methods.
The article also points out that the method is not nesseserily limited to vista, and could see usage on other systems.
By the sounds of it there's not much can be done to stop it...