Tools that run this technology are able to determine whether an application contains virus, spyware or other malicious code as they attempt to install and / or run any non-standard or suspicious code on a system.
This method allows very efficient virus and spyware detection even for not-yet-signed threats.