https://blog.wireshark.org/2010/08/antivirus-outbreak/
I have used Wireshark and I like it.
You are correct and that is what makes finding the virus and deleting it so difficult.
The virus writers are so smart! I wish they would use their brains and time for good instead of this stuff.