Interesting tutorial!
I never thought of that before... What about heuristic analysis? Wouldn't that still detect it as having !trojan-like" or "virus-like" features? (i.e. NAV2002 would still not be fooled by it!)