There is no recorded instance of any malware ever having climbed up through the modem or router and installing itself.
You are totally wrong. I can't recall the names (CIH / Tjsernobil?) because last time I've seen them is 15-20 years ago. But there where (are?) several that do.
CIH couldn't even climb a ladder. It is a virus, limited (ATM) to W9x. However I did see one day Nimda "climbing up the modem", but the computer owners had IIS installed and running. The clean-up tech didn't bother to check the machine as he cleaned it... Even without a NAT router, if the invitation isn't there, the malware cannot forge an entry permit. It needs something like a server with active solicitation, or a browser on a hostile page. So I stand by my statement.
There is no recorded instance of any malware ever having climbed up through the modem or router and installing itself.Ummm. Oh yes. Trojans vs Root-kits. There's only one way either of them get onto any box. The user has to install them.
Wrong again. A admin can do it for legitimate reasons.
Ummmm... So an Admin is not a user? Er...

Where's the Face-Palm smiley? Seriously, When Nimda reponded to the invitation from IIS, that was a user deliberately installing it. The deliberation arose from both the owners not advising the techie, and the techie not checking what was running. Remember that IIS can run as a service, so is not immediately visible.
I'm not a system sanitiser, for some very good reasons that don't concern anybody here. However, I have been once--and may be again--a system admin. That means I worked at, and got paid for, the sharp end. The very sharp end.
@RejZoR - I totally sympathise with your opinion on v7 sandbox. I'm running W7HP SP1, and I am constantly amazed at the number of times I would expect some software to be sandboxed but it isn't. I have told both Java and Avast! to let me know when the sandbox is in use. It has never been used.
Avast! IMHO is still the premier AV package. Unfortunately, some of the design team have this idea that we are all incompetent, and that causes us to think that maybe they're pointing the finger 180 degrees out of phase. We find a version that offers the protection we want, with the functionality we look for, then the next version goes does a Microsoft on us. Those who have had to clean the Outlook cesspit will know what I'm talking about: when menus are changed so comprehensively in new versions you need a manual to find what used to be intuitive; when functionality changes so fundamentally that you have to go back to school again...
Just for example, it is essential that users have the ability to quarantine some files from surveillance. I have mentioned (
https://forum.avast.com/index.php?topic=151078.msg1097792#msg1097792) my problems with Avast v7 interfering with my hosts file: this simply should never have happened. I understand that the hosts file can be targeted, and there are certainly vectors that could overcome the read-only file attribute--but that is no reason for Avast! to throw it into the Chest. The file is there for a purpose, and removing it severely compromises the system. And I have not yet figured what Avast! saw there in the first place, unless it thought I shouldn't have "ssl.google-analytics.com" redirected to 127.0.0.1! If any new version of Avast! makes exclusions difficult, then we find using that version difficult. It's easy, really. We just roll back to a version with the functionality we need.
OK, tomorrow's Sunday, it's very close and I have dogs to work out.
Edit: Eddy has a point. Can we has skins?
Gordon.