You can indeed blame spyware if it installs a system-wide hook. Still, I'd think a memory leak in a module more likely than a hook in spyware only affecting one process.