How can a malware scan be effective if all the code can't be scanned? Imagine if antimalware only scanned exe files and ignored dll files.