My Google-fu is failing me at the moment, but I remember a piece of malware actually included the copyright string of a disassembler so it would detect "itself" and not let you analyze the malware sample.