Full disclosure: I used to work for an AV software company and personally think that AV is a dead technology.
It's true that the world is full of auto morphing malwares, but you can still detect them new variants through heuristics. Which in turn delivers the results to what is generally known as some sort of Antivirus Cloud Lookup or File Reputation Lookup.
Also the AV industry shares information between them. So in the background you don't have anymore analysts looking at every sample file. Instead there's automation that analyses each incoming sample.
The old scan databases you prefer to are usually last line of defense now days if all the other technologies before haven't been able to show the file to be known good file or bad file.
Full disclosure: I currently work for computer security company.
Heuristics are not a new thing in the AV industry and have been in the works even before the dotcom boom. Even with advances in it, it has been proven to either not scale or be absolutely worthless.
Anti-virus "cloud lookup" is just a stop-gap between signature updates. It's not a new idea and all you're doing with that is cataloging MD5s and making them available via whatever network server you choose to use. It's still a signature.
Here's a perfect example of why AV is useless: until 64-bit Windows was commonplace and before XP support was dropped, it was ineffective in stopping the likes of Aleurion (also known as "TDSS" or "TDL").
How did this malware work? Well, in its many, many different permutations, it would get dropped on a machine, become executed, and if the machine was running XP Service Pack 2 or less, it would make use of a vulnerability in the print spooler, get system-level control over the computer, and then it would infect the master boot record with its own bootloader.
How does AV remove it? Well since every time you reboot, it restores its copy of the malware, all it can do is scream that the world is falling because it can do absolutely squat about it. You have to remove it from the bootloader and then do a scan afterward while having taken the system offline.
What fixed the problem? Well applying a patch in the OS is what fixes the issue once and for all--SP3 was the easy way.
If heuristics really worked as you suggest it does, we wouldn't see Cryptolocker and the likes getting around AV. AV evasion is better than ever and heuristics have done absolutely nothing to solve the problem.
Here's what typical AV scanners go looking for when running in their "optimal" settings:
http://community.landesk.com/support/docs/DOC-6651/diff?seco...
Not all Turing-complete languages are scanned. For example, CSS3 is Turing-complete but by default it is not looked at by AV scanners.
However, one can do some nasty things using CSS. An example would be when a troll was posted on a site that appeared to show some sort of Linux-based privilege escalation when in fact it had several <span> tags scattered about that would have not shown up in the browser but did so when text was copied.
This sort of thing can however be defeated by just scanning the web content coming through (and most modern AV software has this already), but even then an attack like that isn't simply going to be just picked up so easily.
I am well aware of where files can create havoc Turing-complete or not (such as my MP3 example), but at the very same time you're going to have headaches if you decide to scan every single file.
This again goes back to my whole point of saying that AV is a dead technology because you really shouldn't trust any file but it is not effective to scan everything either.
because something is "Turing-complete", does not imply it is capable of mischief.
something can be capable of mischief, yet not "Turing-complete."
We're at a point now where what may have worked as a defence against stuff being found on floppy drives just isn't able to scale for today's modern infrastructure.
AV is really a last-line of defence against being forgetful, and nothing more.
You're oversimplifying modern AV by acting like it's just a signature based file scanner. That's just a one defence of many in a good AV product.
What the problem described in the story is that files are being picked up by an overzealous AV scanner doing disk-based scanning. It's reading non-executable data as executable and throwing alerts or performing whatever actions are dictated as per policy.
AV is not there to stop zero-day attacks--if it were, I would not be having this conversation today.
What you're describing is web filtering and this can be achieved using methods either internal or external--an external example would be a solution from OpenDNS and an internal can be whatever appliance makes you happy. AV vendors have thrown in web filtering as a part of their suite, but it still relies on your system being up to date and not already infected. An external solution to your endpoint is a far better solution really.
I am not oversimplifying things when I say that AV is ineffective at stopping CryptoLocker because file-based detections are useless when there are thousands of copies of the malware generated every day.
AV is dead because there is not enough manpower and coverage to stop things like CryptoLocker. It is better to spend those resources trying to prevent the spread of malware using other methods.
May be because I'm just biased because the damn thing used to start running every time my gaming session is heating up ...