It happens all too often that these changes are simply to fool the scanners. Among the most common of these is a form of code analysis. A second possibility is that the scanner will set up a virtual computer in RAM and actually test programs by running them in this virtual space and observing what they do. Such scanners may also key off of code fragments that appear similar to, but not exactly the same as, known viruses. The major advantage of scanners is that they allow you to check programs before they are executed.
Scanners provide the easiest way to check new software for known or suspected viruses.
The peril here is that if too many people depend solely upon scanners, newly created viruses will spread totally unhindered causing considerable damage before the scanners catch up with the viruses. This virus was not detected prior to its destructive activation on November 1, 1991. This indicates the potential hazard of depending upon scanner technology for complete virus protection. Another major drawback to scanners is that it's dangerous to depend upon an old scanner . With the dramatic increase in the number of viruses appearing, it's risky to depend upon anything other than the most current scanner.