Please don't misinterpret what I said...

A/V is probably a necessary evil on corporate workstations, file servers, and email servers. You need to control all entry points, and thumb drives are one of them. But on your web servers, databases, etc, these machines should have a dozen levels of security in between them and any end user. A/V is more of a liability on a web server than an asset, as this incident shows.

Lastly I'd like to add that even on corporate workstations, A/V should mainly be seen as a defense against thumb drives, since they can't be controlled by network policy. You should already be blocking known spammers, porn and warez websites, bit torrent, etc. So those should not be entry points anyway. If they are, you're doing something wrong.