However, behavior-blocking software can catch the malicious code once the Trojan Horse tries to take any action at the desktop, such as modifying the registry or deleting a file, he says. The message appears to be legitimate, but it's not. It converts the Trojan assembler code into executable code by using an engine in the script and turns the user's machine into a stealthy FTP server, Elzam says. He adds that the machine can then become the hacker's conduit to the organization's entire infrastructure. The bottom line is that companies need both traditional antivirus software, for the known troubles, and behavior-blocking software, for the new problems.
Security experts recommend leaving antivirus scanners at the gateway rather than at the desktop.
That's because it's difficult to keep desktop antiviral apps updated with the latest virus signatures, which gets even more complicated with employees going mobile, he says. Earlier versions of behavior-blocking software often stopped legitimate apps as well as the nasty ones, which hampered the program's acceptance. And there haven't yet been any widespread stealth attacks to justify it. Meanwhile, companies that run behavior-blocking software today say it too has its quirks. Depending on how the software is configured, a desktop user can override an alert and opt to run the bad code instead.