In its simplest form, behavior blocking monitors file activities, preventing certain modifications to the operating system or related files. For example, behavior blockers may monitor the system registry, and warn users accordingly if a file being executed is attempting to modify it. Some programs, of course, do this legitimately, i.e. a SETUP program. Other files, however, may have malicious intent. The key benefit to a behavior blocker is that it questions whether the action was expected and whether the user wants to allow it.
While some users find behavior blocking intrusive, it can be a valuable addition to defending systems against the threat of viruses and other forms of malware. The biggest downside to behavior blocking is that it requires a higher level of expertise on the part of the user, who must individually make decisions about what is - or is not -allowed.
One example of behavior blocking is included in the popular Spybot Search & Destroy which includes advanced features dubbed TeaTimer and SDHelper (neither are enabled by default) that use behavior blocking to guard against unintended registry edits as well as to guard against unauthorized installations of ActiveX controls.
It bears repeating, however, that behavior blocking is best kept in the hands of an experienced user who can understand and respond appropriately to the types of alerts it delivers. And behavior blocking can't clean up an infection that's already present, which is where signature-based antivirus scanners have a distinct upper hand.
