I actually tried to hex a trojan before like subseven just to see if it was caught or not. And it still was picked up as the same subseven trojan. That is because they are virus "patterns" the pattern of the actual program is the same because it is still essentially executing the same commands.

And yes Nihil I think you are right about custom packing. This happens with password protected zip files all the time. It could at least lead you to suspicion.