There is a lot of fairly dumb, automated malware floating around (especially for the Windows desktop platform) that is very nasty if allowed to install. Antivirus software can generally detect this stuff before the installer executable, dropper, or whatever runs. Most AV software also comes with transparent filtering proxies to detect exploit shellcode, and other layers of defense.
But there are problems here.
a) This is against generic, spray-and-pray attacks mostly aimed at desktop users. If the attack is customized, novel, highly obfuscated, or targeted specifically at you (e.g. spear phishing attack on a company) then an antivirus has a good chance of missing it.
b) Antivirus engines are privileged processes, and perform various types of analysis (often involving disassembly or virtualized execution) on possibly malicious code. That is a huge potential attack surface.
c) The entire concept of antivirus as real-time defense is not very smart or very future-proof. It detects possible maliciousness by signatures and heuristics; so false negatives are common, and it needs to be updated frequently.
d) The main part of an antivirus, the on-access engine, only kicks in once an attack has already started. Its job is to stop payloads. The memory or program logic exploit that triggers the payload generally goes undetected.
e) There are several modes of attack that an AV engine will not intecept, e.g.
- Stuxnet-type kernel exploits
- Non-persistent snooping in program memory
- Antivirus is not the be-all and end-all of security
- It is a specialized type of security software for dealing with specific types of attacks
- It is hugely helpful in some situations, but that does not make it invariably helpful
and about all, it is not a first line of defense. Your applications (via exploits) and your brain (via social engineering) are what get compromised, so they are always the first line of defense. Your AV is there as a fallback measure. That does not mean it's useless, but that does mean you shouldn't rely on it too much.
And now some disclaimers:
- I am an IT worker, not a security consultant, so don't take what I say at face value.
- I have a vested personal interest in antivirus software disappearing as a popular concept, because I believe the approach is unsustainable, and commercialized to a harmful degree.