This seems to be a heuristics module employed only by the HTTP filter, as the files that NOD32 v3 detects upon download using this algorithm won't be detected by a right-click scan. Is there any reason why this algorithm isn't incorporated into the other scanning modules?