[throwaway211]

https://news.ycombinator.com/item?id=40561915

[alkonaut]

Is the executable updated before each run, and not merely the data (definitions/patterns) used? Because running as root, being closed source, and updating the virus definitions daily wouldn't be surprising.