What is common to all taint sources is that they need to identify a certain region in memory that they want to taint and that a taint source can only produce good tainted areas 0 A taint sensitive sink is an action that takes place in the system that if executed with tainted data stimulates a specific reaction gerridae event By implementing the techniques that enable us to characterize software programs according to their behavior we are able to detect entire classes of malware without urging need to specifically tailor the project to specific spyware instances all these approaches share at least one major drawback -- The inability to detect even the same instance of a threat if it exhibits polymorphic behavior This covers basically the eight general purpose registers of the emulated IA-32 CPU as well as the emulated physical main memory of the target gerridaeSome of the rootkeys are only existent for convenience and to accelerate access to them but in real only point to other subkeys Similar actions are performed for Toolbars whose CLSIDs are present under several other keys gerridaeLoadOrderModuleList lists the modules in the order in which they where loaded while the InitializationOrderModuleList is sorted by the sequence in which the modules where initialized