Anti-malware software can’t spot all malicious code. Is isolating end-user tasks through virtualization a better approach to security?