Flame was signed by a trusted signer (Microsoft in this case) due to a bug that allowed code to be signed with a Microsoft key that was meant for something else

Flame was signed by a trusted signer (Microsoft in this case) due to a bug that allowed code to be signed with a Microsoft key that was meant for something else. People would like to make behavioral stuff, but it's quite difficult. Sandboxing sounds great, but it requires more processing power to run a VM, and the biggest complaint most people have about AV software right now is that it slows down the computer, so running in a VM with a behavioral model...yeah good luck. It looks great on paper, but has no been put into good use yet. If you like to be secure, run 2 boxen, one that has no service except a logger, log everything from your main box, only log into the logger box from console when you want to look through the logs to see if something has gone awry. FD: I work for a security company, and no, none of our products works like that. Most (all?) customers have a higher priority on useability of their network and computers than on security.