I don't want to turn this into a p..... contest about what's better or what's worse.
For my 1.5 cents, the infection likely came via messenger and with out a good firewall, it was free to invite others over for the weekend. If SAS had been resident, it may have stopped it. Providing the first ones in the door where ones SAS could detect. About 50+ files where removed after a SAS scan.
There is no doubt that a resident scanner is better than an on demand scanner. But it's not infallible. People still have to watch what they are doing and check as soon as they suspect something is up.
Look at my sig, what you see is what I got. The worst I ever had was a toolbar.
and you don't want to know where I've been.