> This is an extremely severe design issue, where an Anti Virus can not only be bypassed, but it can actually be used to compromise an attacked system. Don't w

> This is an extremely severe design issue, where an Anti Virus can not only be bypassed, but it can actually be used to compromise an attacked system. Don't we have exactly that design issue in all anti-virus tools, by definition? All potentially dangerous data is routed through that single tool that runs with high permissions and performs complex computations. Every single programming error in the anti-virus tool (e.g. a buffer overflow) can potentially lead to a compromised system. An attacker can now choose not just between vulnerabilities of browser, mail client and operating system, but also use vulnerabilities of the anti-virus tool. So anti-virus is by definition a tool with complex behaviour and a large attack surface. For many security people, this alone qualifies anti-virus tools as additional threat, not as part of the solution - even without dramatic failures as shown in this particular case.