Antivirus software scans a file, program, or an application and compares a specific set of code with information stored in its database. If it finds code that is identical or similar to a piece of known malware in the database, that code is considered malware and is quarantined or removed.

Traditional detection-based antivirus products have had a strong hold on the security market for years. However, recently, due to an exponential rise in cybercrime and malware, these traditional antiviruses have been rendered ineffective against many emerging threats. Today, hackers are better equipped than many cybersecurity companies, with their own quality analysis labs and penetration tools to verify if their new malware samples are being detected with bootleg multi-engine scanning sites. If identified, hackers modify the code and perform the same test until the malware goes undetected.