The fundamental problem is that anti-virus software operates on the principle of enumerating badness: a list of known viruses and their signatures, a list of suspicious patterns in binaries such as obfuscation techniques.

OSes should move to the opposite strategy, enumerating exactly what is allowed, and dropping anything else by default. The challenge here is that the granularity should be small enough for this to be effective, but on the other hand this gives configuration overhead for the user. For example, the firewall could enforce that only the user's preferred email application is allowed to send and receive mail. Currently the permissions in plugins and smartphone apps are too broad to be meaningful, but they're already experienced as a nuisance, so it's a difficult problem.