there are some trojans specifically designed to disable AV and/or firewalls in preperation for sub7 ,netbus etc.. in order to avoid detection.