Are Behavior Blockers Better

Scanners and behavior blockers both attempt to stop viruses, spyware and other bad programs. The approaches used by scanners and behavior blockers are complimentary when a skilled user applies them.

Traditional anti-virus products offer protection by blocking bad programs from running. There is virtually no level of expertise required by the user, the scanner recognizes a bad program and will not let it run. You might call this an intelligent approach. Good programs run without the scanner bugging you and bad programs are blocked, regardless of whether you are an expert or a novice.


Behavior blockers do not care what the motive of the program is, they stop certain things from happening. Airport security is a lot like a behavior blocker.  It doesnt  matter if a person is the best surgeon in the world, the doctor cannot take a knife onto an airplane. Behavior blockers do not generally care what the program is, if it tries to perform a specific action the behavior blocker will stop it. If the behavior blocker is set to stop programs from writing to the registry then many bad programs will fail to work and many good programs will be completely unusable as well.

If you wish to use a behavior blocker effectively it generally requires that you understand a lot about computers. You have to know when to tell the blocker an action is ok and when to say no. If you say no all of the time you will not be able to use much software. If you say yes all of the time a behavior blocker will not help you and it will probably annoy you so much that you remove it.


Is a behavior blocker right for you? It depends on how much you know and what your tolerance is for interruption. If you know what it means to write to the hosts file, the start menu, HKCU run, HKLM RunOnce, and so on then you may be able to use a behavior blocker effectively. If you do not understand when these actions are or are not ok then a behavior blocker is probably not the right security approach for you. If you try to install a networked printer a good behavior blocker will probably warn you. Will you know that it is your printer installation program that is changing your hosts file, why it is changing it, and if it is ok? Is it ok for a chat program to modify the hosts file…

– Nathan


I've started MalwareTips in 2010 to help people solve their computer problems. My area of expertise includes malware removal and computer forensics. I'm active in the various online anti-malware communities where I do researches for new malware threats as they are released.

We love Malwarebytes and HitmanPro!

We really like the free versions of Malwarebytes and HitmanPro, and we love the Malwarebytes Anti-Malware Premium and HitmanPro.Alert features.

Malwarebytes Logo Malwarebytes Premium sits beside your traditional antivirus, filling in any gaps in its defenses, providing extra protection against sneakier security threats.

Malwarebytes Premium Features

HitmanPro Logo HitmanPro.Alert prevents good programs from being exploited, stops ransomware from running, and detects a host of different intruders by analyzing their behavior. HitmanPro.Alert will run alongside your current antivirus without any issues.

HitmanPro.Alert Features