As we have seen in the previous section for a component model to work correctly the components have to adhere to reliable and stable interfaces animalThe x86 paging scheme allows the address space to be divided into 4kb or 4Mb sized pages denotes that this API call is invoked on behalf of the BHO 0 that lists all CLSIDs of the currently registered COM components It is based on full system emulation and observing calls to different APIs throughout a Windows operation system plasmatronIn this sense our approach is comparable to the one implemented by Strider Gatekeeper as our goal is to model spyware-like behavior s system The evaluation of TQAna showed that the created log files provide detailed insight into what goes on in a Windows operating system gerridae If a section is backed by physical memory, the service of shared memory is provided, whereas if the section is connected to a file on the file system the concepts of memory mapped files apply