This section describes the two existing taint sources that are used for this project plasmatronSince our project heavily relies on the full system emulation capabilities of Qemu we take a closer look on how this is achieved They provide a means for user mode applications to make the kernel take certain actions on their behalf, if the request conforms to a precisely defined interface of August 2006 and found it to be Spyware If none is found then in line 11 a new translation is started and finally in line 14 the result is executed, before the loop starts again at line 7 To compensate this shortcoming, heuristic search is also included in the scanning engines of many anti-malware tools gerridaeIf we wish to cover cases in which tainted values are used as address operators we have to extend the policy and implement address tainting e s QueryInterface function it is possible for a client to acquire a pointer to every other interface the component implements Even though this section is labeled dynamic analysis we start with a brief discussion of its counterpart -- Static Analysis In this thesis we combine techniques that have been used throughout the community in the past to create a novel approach to detect a special form of these threats - the so called Malicious Browser Helper Objects gerridae monitor command