The most intuitive answer is to do your online checks before any sensitive data is present, and then to air gap the computer immediately. This is easily achieved on an ongoing basis by keeping the most sensitive data on a removable hard drive. Even if the software is spyware, it will be much harder for it to exfiltrate your data without an internet connection. I would do all of this at the beginning (on a fresh install) and never install any software like this until you are ready to format again.
Imagine this scenario:
- First you install some software that turns out to be spyware
- You airgap
- The spyware collects your information into ram, and holds it there waiting for an internet connection.
- During the next internet connected phase, the spyware phones home your info from ram.
This is a somewhat convoluted scenario, but it's certainly possible, and a good reason to be paranoid about what you do or don't install.
At the end of the day, it may be better to avoid such software if security is paramount to you. There is lots you can do to help prevent data being exfiltrated by a malicious program, but once you have been compromised all bets are off. Attackers are very smart.
For truly secure systems that need internet connectivity, periodic audits are necessary to ensure no data is being leaked. To be absolutely sure, you will need to also review source code where possible, and even reverse engineer programs to check them for hidden network functionality.
Port scanning yourself often is also a positive tactic.
- You can't be sure if programs are stealing your data without rigorously checking.
- Check often.
- Or just disconnect from the internet.
- be very careful what you install.