I'm guessing that some virus signatures detect packers instead of unpacking the code and detecting malware code there.