Since we need to track the taint information in main memory as well, changes to the MMU became necessary Since the scheduler decides what thread to run next on the CPU there needs to be some means to pause the execution of the current thread and start running another thread instead that is enforced on hardware level The third list MemoryOrderModuleList simply has the modules sorted by their base addresses gerridaeBy creating component libraries a software vendor can use the same components for many different applications and has to manage only one instance of the library gerridaeFirst by characterizing the behavior of malicious software there is no need to keep a large signature database, and perform the necessary procedures to keep it accurate gerridaeBy implementing the techniques that enable us to characterize software programs according to their behavior we are able to detect entire classes of malware without urging need to specifically tailor the project to specific spyware instances