Antivirus, on the other hand, looks at software that wants to run on your device and compares that against a list of known bad executables and, along with heuristics, against a list of known bad behaviors. So AV would stop CryptoLocker by blocking the encryption behavior, and IPS would (theoretically) block it by blocking traffic to its C&C server.