A sneak peek on Emsisoft’s version 11 series

[SloppyMcFloppy]

+1 for Emsi.

At least they let users know there is problem and fully explain situation.

Microsoft Update breaking something is not unusual. If it is due an M$ update, I would not be surprised. It happens all the time with other softs: Sandboxie (regularly), Bitdefender, Kaspersky, etc.

Bad M$ update is M$ problem, not Emsi. Emsi and other vendors are forced to fix issue that they themselves never created.

I'm just going give 50/50 for Microsoft and Emsisoft.

 

[hjlbx]

Must have IP addresses. It depends upon AMN infrastructure. It also depends upon whether or not Emsi wants to share addresses.

Would have to create a global firewall rule to block the AMN server IP address(es). AMN lookup is hard-coded.

With all that, I thought most straight-forward, simple solution was to block network access...

As far as EIS 11 testing, I meant the new protection features.

Yes. People will find bugs - and getting those reported and fixed is important as well. Emsisoft fixes bugs. I know. I reported and they fixed it. Some took 6 to 8 months, but they were fixed.

I am much more interested in their newly added protections. How well do they work ?

Extremely difficult to test fileless malware unless you have access to actively hosted test sample. See what I mean ?

 

[Deleted member 178]

Lol HJ , you quoted yourself

Can someone check where is EIS v11 folder? Program Files or Program Files (x86)?

 

[XhenEd]

Roughly speaking, when are they going to release the final version? Before 2015 ends? Or is it gonna be early to mid 2016?

Please no "soon" or "when it's done". lol

 

[SloppyMcFloppy]

Roughly speaking, when are they going to release the final version? Before 2015 ends? Or is it gonna be early to mid 2016?

Before 2015 ends i doubt.

 

[hjlbx]

Lol HJ , you quoted yourself

Can someone check where is EIS v11 folder? Program Files or Program Files (x86)?

No pay attention. I is Polish makings mistakes...

 

[Online_Sword]

Must have IP addresses. It depends upon AMN infrastructure. It also depends upon whether or not Emsi wants to share addresses.

Would have to create a global firewall rule to block the AMN server IP address(es). AMN lookup is hard-coded.

With all that, I thought most straight-forward, simple solution was to block network access...

Completely blocking the network access might influence your tests on malwares that require network connection.
According to Fabian Wosar, "the cloud backend used by EAM is hosted in the same server cluster as the updates".
We have known the domain name of the update server is "dl.emsisoft.com".
So, I think maybe you could block this domain in your /etc/hosts file and block the corresponding IP in the firewall of your real machine.

 

[NZRADAR]

Maybe in there time, Emsisoft would give us the pleasure of seeing there products New Version in Action via a video since they are testing themselves against Exploits Scripts Tricky startups and Fileless Malware. I am glad they are reaching into these obscure and devious malware to further protect their customers. I like company's that set there sights high.

 

[hjlbx]

Maybe in there time, Emsisoft would give us the pleasure of seeing there products New Version in Action via a video since they are testing themselves against Exploits Scripts Tricky startups and Fileless Malware. I am glad they are reaching into these obscure and devious malware to further protect their customers. I like company's that set there sights high.

All one needs to do is to discuss topics on the Emsisoft forum. Emsi staff gets it... and responds to user concerns and requests. If enough users express concerns and ask for a particular critical feature, then it usually ends up being integrated into Emsi products.

Fileless malware and scripts have been discussed regularly on the forum since early 2015. Plus, Emsisoft keeps close track of emerging threats and actual user infections. If they see an uptick in a certain type of infection, then they react. Perhaps they do not do it as fast as most would like - which is yesterday - but they do constantly add and refine their protections. I know they constantly tweak their Behavior Blocker... which is a never-ending task as threats change.

Emsisoft is a very small team. So their response time can be slow. However, I will tell you that their fixes are at a much faster pace than other security soft vendors. Ask anyone who is a regular bug reporter to Bitdefender, Kaspersky, Comodo, Avast, Norton, etc, etc.

Put in a request for a video demonstration on their forum. I wouldn't be surprised if it is already in the works...

 

[Exterminator]

Back on EIS 10 on Windows 10.Gave the beta 11 a go but just terrible internet connection so for the time being I will stick with version 10 on one Windows 10 machine.

 

[Emsisoft]

A word on the "Autonomous decisions":

Until version 10, the Emsisoft behavior blocker required online lookups to make definite decisions whether a file is good or bad. Our goal is to make the behavior blocker itself smart enough to be able to tell if a file is malware or not, with absolute certainty. So we won't even need to look it up online if a specific behavior pattern leaves no space for error. That's probably not possible for all types of malware soon, but for some of them it certainly is and version 11 is the first step towards that.

 

[hjlbx]

A word on the "Autonomous decisions":

Until version 10, the Emsisoft behavior blocker required online lookups to make definite decisions whether a file is good or bad. Our goal is to make the behavior blocker itself smart enough to be able to tell if a file is malware or not, with absolute certainty. So we won't even need to look it up online if a specific behavior pattern leaves no space for error. That's probably not possible for all types of malware soon, but for some of them it certainly is and version 11 is the first step towards that.

@Emsisoft that's great !

 

[Exterminator]

A word on the "Autonomous decisions":

Until version 10, the Emsisoft behavior blocker required online lookups to make definite decisions whether a file is good or bad. Our goal is to make the behavior blocker itself smart enough to be able to tell if a file is malware or not, with absolute certainty. So we won't even need to look it up online if a specific behavior pattern leaves no space for error. That's probably not possible for all types of malware soon, but for some of them it certainly is and version 11 is the first step towards that.

That is good news

 

[hjlbx]

I disagree on that.
For EIS v10, even the stable version has some bugs that are easy to find with no knowledge on sample types.
I think this also holds for v11...

By the way, if you want to test without AMN, maybe you can config the firewall in your real machine (I assume you test the software in a virtual machine) to block any connection to the server of EMSISOFT.

I forgot that Emsi still has setting to disable AMN query. I test so many softs I forget about individual settings.

Apologies @Online_Sword

 

[Secondmineboy]

A word on the "Autonomous decisions":

Until version 10, the Emsisoft behavior blocker required online lookups to make definite decisions whether a file is good or bad. Our goal is to make the behavior blocker itself smart enough to be able to tell if a file is malware or not, with absolute certainty. So we won't even need to look it up online if a specific behavior pattern leaves no space for error. That's probably not possible for all types of malware soon, but for some of them it certainly is and version 11 is the first step towards that.

Thats great to see and was also the cause of a bad test results in a Test from AV-Comparatives this year Nice to see that improvement there.

 

[Online_Sword]

I hope Emsisoft could release v11 before the end of this year, such that it could take part in the Behavior Blocker test of AV-C.
I remember that Emsisoft was the Champion of this test in 2011.
But after that, Bitdefender has won the first place for four years.
That test is conducted OFF-line. So, if emsi has implemented a more intelligent BB that is less dependent on AMN, I think it could get a better score in this test than before.
On the other hand, Bitdefender now has upgraded its BB from AVC(Active Virus Control) to ATC(Advanced Threat Control). I guess it also improves its BB significantly.
It is interesting to guess who will be the next champion

 

[hjlbx]

I hope Emsisoft could release v11 before the end of this year, such that it could take part in the Behavior Blocker test of AV-C.
I remember that Emsisoft was the Champion of this test in 2011.
But after that, Bitdefender has won the first place for four years.
That test is conducted OFF-line. So, if emsi has implemented a more intelligent BB that is less dependent on AMN, I think it could get a better score in this test than before.
On the other hand, Bitdefender now has upgraded its BB from AVC(Active Virus Control) to ATC(Advanced Threat Control). I guess it also improves its BB significantly.
It is interesting to guess who will be the next champion

Bitdefender improvements are as slow as thick mud rolling down a hill... but, I will say, their behavioral heuristics are good. It's just too bad they can't seem to get long-standing, nagging bugs sorted out. Because Bitdefender is a slick, automated security soft.

Nevertheless, it still needs to be supplemented with at least Sandboxie, if not also an anti-executable. It's script protections are weak in some areas.

Emsisoft is better (and so is Comodo).

 

[SloppyMcFloppy]

Bitdefender improvements are as slow as thick mud rolling down a hill... but, I will say, their behavioral heuristics are good. It's just too bad they can't seem to get long-standing, nagging bugs sorted out. Because Bitdefender is a slick, automated security soft.

Nevertheless, it still needs to be supplemented with at least Sandboxie, if not also an anti-executable. It's script protections are weak in some areas.

Emsisoft is better (and so is Comodo).

Comodo is good for preventing but not for detecting because their signature are nowhere near BitDefender or ESET.

 

[hjlbx]

Comodo is good for preventing but not for detecting because their signature are nowhere near BitDefender or ESET.

Comodo doesn't need detection to protect system...

 

[jamescv7]

@user102: Well that's what we call balance protection, sometimes signatures are not the sole solution which why default factory settings of secondary components like BB of Comodo should take care for it. (Besides HIPS and Auto Sandbox)