This is the paper. http://www.bcs.rochester.edu/people/Daphne/Li_NN.pdf

Spybot-S&D does come with a program called TeaTimer (yes, another startup program, but it's small) that monitors registry changes including startup entries, popping up a dialog asking whether to allow the change, so if a program decides it wants to run at startup, you can block that right there.