Yeah, I get that, I'm just unconvinced that using lower level, less documented APIs, which are not necessarily meant to be the way users interact with the system, is a good heuristic for malware detection.
I'm ignoring the fact that very few people in the world need an antivirus (other than maybe elderly/less technologically knowledgeable people, but even then I'm not sure they can be fully protected)
I'm ignoring the fact that very few people in the world need an antivirus (other than maybe elderly/less technologically knowledgeable people, but even then I'm not sure they can be fully protected)