Anybody who's ever thought about how an antivirus product works has come to this conclusion: Antivirus will detect software that does things that are known to be bad, but not software that does things in a new way. Depending on the level of sophistication of the antivirus solution, that either means a completely black-and-white distinction between what matches what is essentially a rainbow table of MD5 signatures and what doesn't, or more complex binary analyses like what kinds of actions an application binary performs, or what IP address ranges it attempts to establish a connection to.

Now, this doesn't mean that antivirus is useless, or that the antivirus era is over--by the logic of this post, the antivirus era was over the minute it began. What it means is that antivirus is a tool that helps protect you against "stupid"/mass malware, but not a tool that gives you any kind of "complete" or "100%" protection (although every AV vendor will certainly try to convince you that their products do), and this is particularly true--today as it was 10 years ago--when it comes to malware that isn't widely distributed, or, put more fashionably, "targeted malware" and "advanced persistent threats" (hence: malware which belongs to a "family" that hasn't been caught, analyzed, and added to a binary/behavioral signature/heuristic database of some kind beforehand.)