AV works usually after main virus spreading because definitions are upgraded in quite significant intervals contrary to purely automatic virus infections. I found most AVs more effective in looking for politically-incorrect programs than real viruses. They're detected as "generic malware" usually.
A few examples:
- My own program in WinAPI to run another program with clock's date changed back for a very short moment (typical behavior of crack, this time I cracked TIP with a full blessing of manufacturer ).
- Original driver for keypad (this is quite wtf, but it works in all its versions).
- Package for programming in ladder logic for an old system, obsolete according to manufacturer - I wonder how much money AV companies got to classify it as virus and make people buy a new drivers/software...
- A few EXE patches and updates of my make to modify resources in existing programs.
I think it's better to have some good network firewall and process monitor which asks about what a new process starts to do.