I think AV programs are just way better these days, especially with live detection and sharing of virus signatures between the different companies.
With sensible tools like Web Of Trust on all web browsers we use, live scanning by Nod32 and blocking websites at the firewall that have been blacklisted by various AV companies I've noticed far less infections over the last 2 years or so.
I also do not run any AV outside of the MS defender that came standard with my windows. I think that most malicious tools/viruses these days encrypt their payloads therefore bypassing most AVs. At all of my penetration test projects that i have done all my encrypted payloads have bypassed the clients AV.