Poll with comments: skill tree.

I've said many times that it's necessary to protect data in physical memory from heroes, even in the context of using *. Implementing memory protection is practically impossible or quite expensive. But, we can take a different approach – intercept Open Processes and either list them or block them (kill them). The latter option is similar to a rootkit, which all antivirus programs will detect. Therefore, a listing of processes by the MD5 hash of the EXE and DLL files, followed by a mechanism for either alerting or blocking, is still needed.
...