App Review Emsisoft Anti-Malware 12 Behavior Blocker Test (without cloud assistance)

[RejZoR]

Remembered Emsisoft also features behavior blocker, so here is a test of it without their cloud capabilities, forcing behavior blocker to do all the heavy lifting on its own. To my surprise, very good results. If I'm really honest, I didn't expect results to be this good. Especially with ransomware, but they did implement special detection routines in version 12 and it seems to be indeed working really well. Good job Emsisoft.

 

[SHvFl]

Nice test. It's obvious EAM behaviour blocker is one of the best if not the best and the test proves it.

 

[Der.Reisende]

Impressive results by EAM! Thank you for sharing!

 

[Kami7]

This video only confirms the Emsisoft is one of the best on the market Thanks for test!

 

[tim one]

I'm using Emsisoft on the other PC and I have to admit that its BB is absolutely one of the best.
A question: is it the evolution of the old Mamutu ?

 

[SHvFl]

I'm using Emsisoft on the other PC and I have to admit that its BB is absolutely one of the best.
A question: is it the evolution of the old Mamutu ?

It's the successor. Probably they used the general idea and maybe even code for EAM/EIS.

Emsisoft Mamutu end of sale

 

[tim one]

It's the successor. Probably they used the general idea and maybe even code for EAM/EIS.

Emsisoft Mamutu end of sale

Thank you @SHvFl
It is a pity that they have abandoned the standalone BB!

 

[Emsisoft]

Mamutu kind of only was a demonstration product of Emsisoft Anti-Malware's behavior blocker capabilities, in a time when nobody thought, behavior blockers would have any significant relevance in the antivirus world. We stopped it after a few years because demand for a standalone product couldn't pay for the development time, but it's the same tech that's now incorporated in EAM and EIS.

 

[SHvFl]

Thank you @SHvFl
It is a pity that they have abandoned the standalone BB!

It was probably because the bb is so good as shown in the video that many would skip the whole EAM product. And a standalone bb would have to cost way less to make sense.
So in a sense keeping it alive would probably mean losing money and creating unnecessary competition from their own team.

EDIT: I feel stupid the developer above said the same thing and stupid me 15 minutes later is speculating. Hahahahaha.

 

[RejZoR]

If you look at the history, all the stand alone behavior blockers got bought out by someone and incorporated into larger security programs or internet security packages.

 

[tim one]

It was probably because the bb is so good as shown in the video that many would skip the whole EAM product. And a standalone bb would have to cost way less to make sense.
So in a sense keeping it alive would probably mean losing money and creating unnecessary competition from their own team.

EDIT: I feel stupid the developer above said the same thing and stupid me 15 minutes later is speculating. Hahahahaha.

No problem, double explanation reinforces the concept

 

[AtlBo]

Great test thanks.

Is there any chance that any of top security companies could have failsafes built in to their product so that the sigs or heuristics kick in at a certain point with some behaviors? By this I mean a built in override of the settings (in this case HIPS only). I am considering this possibility with other elements of a security program too.

This would kind of make sense to me that a company might do this, because they aren't thinking of testing and it's their names on the product. I think it's a curiosity to consider this kind of thing, but when I view the tests I try to keep in mind the developers big picture viewpoint. Kind of can't get around being curious about how they think with settings choices, the customer, and the product.

 

[Wave]

No problem, double explanation reinforces the concept

Me and you are always re-explaining things after another and it just helps others so I agree with you If you make a post you can catch me out re-wording and the same vice versa

Official MT Chuckle brothers

 

[Emsisoft]

I don't think behavior blocking alone is the holy grail of security really. It's just one component of several, that sum up to a great security concept. Each component has advantages, but also disadvantages, and the right balance effectively does the trick.

Surf protection is a good first layer of defense because it's blocking stuff long before it can get started. It's a safe bet (technically), but the disadvantage is that you can never have a complete list of hosts to block as they change every minute, and not all malware is spread via websites directly.

File guard usually does the biggest part of the protection job. It's also relatively safe because the scan engine gives clear results on files without many FPs, and after all, it's able to detect >90% of all threats reliably. Downside is that it requires frequent updates. It naturally misses zero day threats that no AV vendor knows about yet (setting side heuristic methods).

Behavior Blocker's job is to provide a safety net to pick up stuff that the other two layers missed. It's really difficult for malware writers to bypass it because the behavior of a program can hardly be manipulated in a way it gets invisible. But the downside is that it is a very blurred detection. Good software often behaves exactly like malware (from a technical view), so that needs to be reliably filtered out. If you turn off cloud lookups in everday-use, you'll probably see many false alerts, so I'd strongly suggest to always keep it on, unless you feel comfortable dealing with alert boxes for good programs.

 

[MalwareBlockerYT]

I don't think behavior blocking alone is the holy grail of security really. It's just one component of several, that sum up to a great security concept. Each component has advantages, but also disadvantages, and the right balance effectively does the trick.

Surf protection is a good first layer of defense because it's blocking stuff long before it can get started. It's a safe bet (technically), but the disadvantage is that you can never have a complete list of hosts to block as they change every minute, and not all malware is spread via websites directly.

File guard usually does the biggest part of the protection job. It's also relatively safe because the scan engine gives clear results on files without many FPs, and after all, it's able to detect >90% of all threats reliably. Downside is that it requires frequent updates. It naturally misses zero day threats that no AV vendor knows about yet (setting side heuristic methods).

Behavior Blocker's job is to provide a safety net to pick up stuff that the other two layers missed. It's really difficult for malware writers to bypass it because the behavior of a program can hardly be manipulated in a way it gets invisible. But the downside is that it is a very blurred detection. Good software often behaves exactly like malware (from a technical view), so that needs to be reliably filtered out. If you turn off cloud lookups in everday-use, you'll probably see many false alerts, so I'd strongly suggest to always keep it on, unless you feel comfortable dealing with alert boxes for good programs.

Couldn't have put it better myself Really good explanation. I recently switched from Kaspersky Internet Security 2017 to Emsisoft Internet Security - I've been testing your AV for a few weeks on the Malware Hub here & also in my own time & I am extremely impressed with the amazing results. And since I won a copy for free in the latest giveaway & because of the quality of the product I switched Big fan Emsisoft!

 

[RejZoR]

I don't think behavior blocking alone is the holy grail of security really. It's just one component of several, that sum up to a great security concept. Each component has advantages, but also disadvantages, and the right balance effectively does the trick.

Surf protection is a good first layer of defense because it's blocking stuff long before it can get started. It's a safe bet (technically), but the disadvantage is that you can never have a complete list of hosts to block as they change every minute, and not all malware is spread via websites directly.

File guard usually does the biggest part of the protection job. It's also relatively safe because the scan engine gives clear results on files without many FPs, and after all, it's able to detect >90% of all threats reliably. Downside is that it requires frequent updates. It naturally misses zero day threats that no AV vendor knows about yet (setting side heuristic methods).

Behavior Blocker's job is to provide a safety net to pick up stuff that the other two layers missed. It's really difficult for malware writers to bypass it because the behavior of a program can hardly be manipulated in a way it gets invisible. But the downside is that it is a very blurred detection. Good software often behaves exactly like malware (from a technical view), so that needs to be reliably filtered out. If you turn off cloud lookups in everday-use, you'll probably see many false alerts, so I'd strongly suggest to always keep it on, unless you feel comfortable dealing with alert boxes for good programs.

Well, certainly. But when behavior blocker alone can pick up nearly 99,99% of everything you throw at it, that means pretty much anything not covered by traditional signatures will with great certainty be detected by behavior blocker. If behavior blocker only detects like 5% or 10% of samples on its own, I wouldn't exactly rely on it catching what signatures miss, unless the missed stuff is exactly those 5-10% of what behavior blocker does detect. But we all know math doesn't work that way when we're dealing with malware.

Which is why I'm testing behavior blockers as stand alone components. To give users general idea how much they can rely on behavior blockers doing the job when you take signatures out of the equation (basically emulating a signature miss scenario).

 

[nikos200]

i love EAM and still hope for a free version!!!!!

 

[Emsisoft]

Our dual-engine scanner is and always was free, but protection isn't, sorry.

 

[509322]

Emsisoft answered, so deleted.

 

[Svoll]

This video and many who has comment on this thread has made me a believer. Thank you for a very informative video.