Not quite right. There are common patterns that lots of malware use. Anti-virus can watch for those patterns. Things like hooking into various places in the kernel is one of those patterns.

>LOL- that "virus" would not be picked up by McAfee. Which is an interesting point: no virus checker can detect a new virus until it is added to the signature library, so even somebody with a virus scanner can be exposed if they don't observe internet hygiene.