02-24-2011, 06:47 PM
It all depends on what kind of string encryptions it's set to detect, and certain snippets of code that are confirmed to be dangerous or malicious. Thats why an AV usually gives you an option to "Help Out" with a check box by sending anonymous data to them, because they use that information to update their AV and protect against more intrusions/malware/viruses.