First of all... what is the classical sense of word in heuristics?
As an introduction (pretty thorough, though), I recommend reading an excellent article written by Technodrome for Wilders Security forum:
http://www.wilderssecurity.com/index.php?board=24;action=display;threadid=2892 . "Reply" #6 specifically discusses heuristics in the classical sense of word. Classical heuristics usually involves some code emulation (i.e. execution of the code that is being analysed, of course in an isolated box). It can be useful mainly for the detection of new/yet-unknown viruses. However, it is never possible to exactly identify the malware with such an approach and is also traditionally prone to false positives. avast! doesn't have any such functionality - it basically relies on its virus database. On the other hand, the way some parts of the avast virus database are constructed (the pre-processing done on our machines) could actually be called "heuristics"...
Maybe Pavel (our virus guru) could explain this in more detail...?
Which is technically better?
In my opinion, in present time heuristics is just a marginal technique whose importance rapidly decreased when most of the AV's made their databases so good that they actually contain
virtually all the virus samples. And with avarage response times in the magnitude of hours rather than days/weeks, the need for
generic detection without a record in the virus database went down, too...
Vlk
