It seems that we are now seeing malware that is very specifically targeted--such as that targeting users on YouTube.
For Version 2.0, instead of complicated heuristics, whn not develop scanning techniques to specifically target this type of malware? Perhaps target a couple of such Web sites/malware techiques--maybe let the user select this option if they want. Come up with a new technique ever once and a while, and you have a ClamWin improvement project. I'm sure you won't lack for targets!

Just a thought...

Regards,