Complexety of detecting trojan droppers

Hi malware fighters,

Trojan droppers is a separate chapter where AV detection is concerned. Some AV products do a good job like KAV and Dr Web, but sometimes they are a bit over-zealous, like Dr Web when it flags a removal tool by Sophos zaflici.com as MULDROP.TROJAN aka multidrop.trojan. Here the heuristics of Dr.Web result in a false positive, on the other hand heuristics with droppers can sometimes detect trojan droppers where others fail.
Read this about the complexity of detecting droppers, and why some may go unnoticed…
http://www.anyspyware.com/trojan-dropper.html

greets,

polonus