When it comes to recognizing current infections we're always going to have to deal with signatures, though we have the ability to match on behavior as well as c

When it comes to recognizing current infections we're always going to have to deal with signatures, though we have the ability to match on behavior as well as code. We might look for things that are run out of the users directories that modify system-wide settings, for example. I think there's a fundamental difference and that is that we can have a central security mechanism in a computer. It's not too hard to link a program to its privileges. For example, you browser should not be writing system-wide settings after it is installed, it shouldn't be forking processes that aren't duplicates of itself, etc. We shouldn't allow a process to add code to another process unless the user deliberately gives the process a higher level of privilege. To draw another parallel with biology, we have the ability to surround every organ with its own barrier mechanism, like the blood-brain barrier and plecental barrier (I don't actually know what I'm talking about, so it's it is a very loose parallel). Basically, we have the power to wrap each process in its own protective sheath which doesn't let things in or out unless we okay it ahead of time. Virus prevention is the future. Newer operating systems are already making progress in this direction.