Well it's certainly not like Script Defender, which blocks scripts from running according to their extention. You can configure it to block the script types you want. It doesn't differentiate between good and bad scripts, it just blocks unless you OK scripts to run. The AVG-AS Guard uses signatures to scan executables as you start running them, if the file is bad according to the data base it will be dealt with as per your instruction to the pop-up. As to AVG-AS examining scripts (which are data files rather than actual programs), I don't think the Guard does realtime (help me out someone if I'm wrong!), but if it does it would be using sigs.