Um...
Because for the longest time, Rootkits didn't exist and anti-virus could detect viruses. Plus, I have yet to see a virus (trojan, etc) that doesn't make its precense known.
By the time rootkits were around, I was at college with an industrial strength anti-virus program. I'm pretty sure I never got one.
Anti-virus is useless anymore on any Windows platform. Period. I don't care how "industrial strength" you think it may be, it sucks. Take it from a malware specialist who spends nearly 40 hours a week doing nothing but manually removing this crap from compromised Windows-based systems and restoring whatever services it has removed or disabled. Automated software isn't going to do for you what you expect. While some fairly good anti-malware based apps like MalwareBytes Anti-Malware are out there, they aren't perfect. Perfect is what you need in the face of today's digital threats.
Malware is playing a whole new ballgame with the power to not only change registry entries, but to hide as threads in Windows critical processes such as Winlogon, lsass, svchost (yes, the actual thread, not a .dll generated svchost process), and many others. They are self-protecting, self-healing, and many Vundo-based Trojans are now crippling the system by restricting Windows Group Policies so that things like 9/10 of the items on your Start menu don't appear or are inaccessible due to permissions denial. Some variants have gone as far as to hook the Winlogon Authentication Package so that when the Trojan is removed, the user can no longer log in to their account unless the Trojan's registry string was deleted in the LSA registry key before the previous logoff or reboot.
Then there's DNSChanger. Ah, a lovely one that redirects all web traffic to advertisers sites before dumping you to the actual website that you requested. ...most of the time. Ever try removing this beast? You'll find that it is indeed a rootkit. You'll also find that is resides in /System32/Drivers. So, what's the catch? You can't see it there. It has designed itself to hide from Windows APIs. Removal requires some pretty fancy rootkit detection software (some anti-virus apps can find and delete pieces of this now), and a bootable device such as a BartPE Disc, Ubuntu Live CD, and a lot of nerve as you go into your drivers directory deleting the rootkit piece manually.
Who wants to do this?!
At this point, nearly all end-users give up and either buy a new PC, Mac, or restore their old one using a restore partition or discs. For those that chose to restore, many forget to patch their 1, 2, 3 year-old factory image and become once again a member of our unfriendly botnet environment in a matter of a few hours.
I believe you're going to see the next round of malware apps attack at a level as low as the interrupt handler. You invoke an interrupt, the malware does its thing, then goes back into a stealth-like "wait" period. At this point, you might as well call it quits...
