Anti-virus does some basic heuristics and signature checking, and honestly, they are doing a pretty bad job at detecting virusses or overlooking them (Flame for example, or the recent Adobe CA compromise)

Mikko Hypponen from F-secure, a Finnish anti-virus company, only had the guts to admit it, you can read the article here; http://www.wired.com/threatlevel/2012/06/internet-security-f...