Comodo antivirus forwards emulated Win32 API calls to the real API during scans. ¯\_(ツ)_/¯ https://t.co/PHOw6vl6X1

— Tavis Ormandy (@taviso) March 22, 2016