Fake servers can deliver "poisoned" definition files that whitelist malware.