Thanks for the elaboration, ChronicRat
eXpl0it3r has summarized the problematic nicely in my opinion. A common misconception is that anti-virus can protect everything and compensate for careless behavior (like installing arbitrary executables).
I'm not using AV since 2006 and I have no viruses.
How do you know? Even with anti-virus software many viruses are not recognized, so how can you be so certain if you have no techniques to detect viruses whatsoever?
Virus patterns have changed a lot over the last years. Around 2000, they were mainly annoying, with pop-ups, forced restarts, deleted files etc. Over time, criminal organizations have started to develop them systematically and led to the emergence of a whole new industrial sector. Today, many viruses and trojans are very subtle -- they can even be inactive for years and waiting for orders. Botnets for example can be a lucrative business, since you can make money with other people's resources (processor time, network bandwidth, clean IP addresses) and the originators are very difficult to track. It is therefore wrong to believe that a system is clean just because the user (!) recognizes no noticeable behavior.
But surfing on questionable websites and executing untrustable files is just one side of the medal. Every software you use, including the operating system itself, contains security vulnerabilities. These are regularly exploited to introduce malware (even if a personal computer may be a less interesting target than a central company server), zero-day exploits are even traded for millions of dollars.
To sum up, there are several widespread fallacies:
- Anti-virus software protects everything
- I see no suspicious behavior, therefore I have no virus
- I am careful, therefore I have no virus