Is the executable updated before each run, and not merely the data (definitions/patterns) used? Because running as root, being closed source, and updating the virus definitions daily wouldn't be surprising.