Your operating system is a building and the virus is a thief
Windows is an Office building
While everybody is allowed to go in and out, they have to pass through security where their bags are checked and they walk through an x-ray. This would be the equivalent of an active scanner. Everything is checked so there's a small chance that anything will get taken through the front door.
Throughout the facility there are cameras and security guards monitoring them to look for suspicious activity. This is the Passive Scan. The security guards are pretty good at pinpointing common mischievous behavior because they spend all day every day watching people.
The kicker is, if the you do the funky chicken dance through the x-ray scanner you'll get through, no questions asked.
An infection goes like this. The thief does the funky chicken dance past the guard at the front. Once they're in and take what they want, they just need to find (or create) a back door to get out with the goods.
If the thieves are unsophisticated, the passive scanners will raise an alarm and send security after them but, if you've watched Oceans Eleven lately, you'll know what I mean when I say, "not all thieves are unsophisticated". Essentially, once a bad guy gets inside, if he's good he'll know how to evade and subvert your the surveillance system so you don't even know he's there. Then it's free game with your data.
Even worse, they're influential. They make friends inside your system (infect other applications) so, even if you're successful in giving them the boot, they can just call up a buddy to let them back in. Passive scanners don't just watch for bad guys, they watch everybody's behavior but they're not perfect.
A Trojan is like a hidden thief hiding out by one of the emergency exits, if he hears a secret knock from one of his buddies outside, he opens the door from inside. You really don't want one of these in your building because they're extremely talented.
A Mac is an Office Building but with a keycard system
Once you enter the building, you have to sign in with the guard to get your pass. But, once you're in you have freedom to move about the areas where you have permission to roam. If you need to get access to the company inventory you need to sign in again for a higher level pass to continue. Every time you leave a level of security, you lose your pass so you have to sign for it each time you need to get back in.
The vulnerability here is, make sure you know that the person you're giving access is supposed to be allowed in.
Linux is like a military base
You have to pass security to get in the gate but you also need rank/title to gain access to parts of the base. For instance, you can't get into the air field if you're not a pilot (and aren't a superior officer), you can't get into the submarine if you're not a sub guy.
Think of the root account as the General. He doesn't need permission to go anywhere because he is the most superior officer on base. Therefore, you don't want to let your general go around letting just anybody into the base (because he'll be obeyed without question).
The trick with Linux is, don't make yourself the General. Make yourself a petty officer who dutifully does his job. Then, when that petty officer discovers he needs some additional resources to get his job done, upgrade him temporarily (the command for elevated privileges in linux is sudo which grants temporary root access) to General to get things moving and shaking.
In reality Linux and Unix use the same security model for privileges. Macs just don't compartmentalize the system like Linux does to make it more user friendly.
The major problem with all of these systems is, once the thieves find a way in, they can create a back door to get back in later without having to go through security.
The only really safe system security wise would be to have a more sophisticated system. Like, go back in time to the beginning of the day at the end of each day. This is the equivalent to sandbox virtualization. Every time you load the OS, it loads a fresh, unadultered copy. No backdoors will exist because the OS will be set back to the state it was in before the thieves ever got in. There are limitations to this method but they're too detailed/complex to cover here.
The trick that most people (some conveniently) overlook is. Once you let somebody into the building and give them access privileges, they can let others in. So, don't let the guy wearing the black and white striped shirt (and, in some cases the little girl with the quantum mechanics book) in the front door in the first place. With the exception of the funky chicken dance, they can't get in unless you let them.
The issue with virus scanners is, people rely on them too much. Consider that neither your active or passive scanners know about the funky chicken trick. You've just freely let a bad guy into your system. If your fortunate, he'll do something that raises the attention of the passive scanner. If your not fortunate, he'll move from shadow to shadow within your system wreaking havoc and you won't even know that he's there.
0-day software vulnerabilities (known software defects exposing a security hole that hasn't been patched yet) are the equivalent to the funky chicken dance. Microsoft isn't the only party to blame for these either; I've seen an Adobe Flash hack get through and trash my system beyond repair in <15 seconds.
Windows/Linux tend not to have the funky chicken problem because you carry your access privileges (keycard, rank) everywhere you go throughout the system.
A rootkit is like having one of these guys kidnap your executive security officer, lock him in the closet, and impersonate him. With the rank as the head of security, he has the power to hire/fire anybody and change policy at his whim. If they get to him you're really screwed because he can lay off the whole security staff or implement policies that force the security staff to stare at their feet and sit on their hands on the threat of being fired. Ie. you really don't want this guy to be compromised.
I hope that helps.