Why cannot outside programs determine the existence of malicious code with 100 percent accuracy?
Users do not update their scanners frequently enough
Firewalls are not intended to detect malicious code.
The purpose of a string depends upon the context in which it is interpreted
The sourced code language is often unknown.