Isn’t it still that when signatures are added at some point it turns out that the malware code has been uploaded months before, or did that change?