JavaJones: heuristics is useful for detecting a piece of malware that has been edited slightly (either hex edited or just some minor source changes), or packed/crypted with some random tool - static checks fail there.
I analyze malware every now and then, and it's nice seeing that Kaspersky's heuristics catches at least some of it, since the code is never allowed to run that way.
I haven't had any significant false positives for years - only thing is that some low-level asm code (like "SEH in asm") is detected as "virtools" by Kaspersky and some other scanners, which is pretty lame - there's nothing virus-related to those. Other than that I've had a few false positives while developing my packer/krypter, but that
is some pretty suspicious code
After heuristics, there's than behavioral blocking - the last line of defence (since this happens on code that has been allowed to run on your machine). This can stop malware from injecting code in other processes and all kinds of other stuff.
An example: when adding random-IV to fSekrit, I needed to save a bunch of copies of the same text with same encryption key, to see if it worked. Kaspersky alerted me that "this process might be a trojan dropper" and offered me to shut it down.
