How does webroot protect from word / excel viruses?

1.) I don't see (yet) any detected or overrides  for .vbs files.  How does Webroot keep us safe from these types of infection?
If it is not "scanning everything all the time" like conventional anti-virus, other than waiting for something to try to execute and then trying to block it how can it be as good or better than conventional AV?  I'd feel save if something is looking inside the.gift horse as it is downloaded, to make sure its not a trojan, instead of finding out when the door is opened.  Is this handled by the option to "Scan on create and saved programs?  ARe all files scanned or just executables?
 
2.) With the way that Cryptolocker is mutating, thousands of strands changing daily, is the only way to really be protected is to lock down the computers and dissallow any and all exe's and dll's that are not on the allowed list?
 
End users should not be permitted to install / execute any type of application, however the concept is met with resistance with SMB clients who can't live without their coupon printers and screen savers......