It basically assumes you're an idiot and asks you "did you really click the mouse just then or was it a virus?"
If so it should most of the userbase from running infected files! (for my assumption I would change 'idiot' to 'unexperienced' though)
The truth is, after being repeatedly asked to continue, users will reply "yes" regardless of what was asked... that's were the strategy fails in my opinion, if not for the part which excludes administrator priviliges while UAC is on. :)
Anyway, while working in tech support, it must be said I heard far less complains about instabilities due to infections than before (which is also due to a solid kernel, even better after SP1, and the integrated firewall and antispyware).