Emsisoft Anti-Malware question

[rocky]

I have Emsisoft Anti-Malware installed as only security program with windows firewall on win.7 x86. Out of curiosity I tried to run Zemana keylogger simulator and it ran with no reaction from Emsisoft Anti-Malware so now I'm not sure what to think. I have fallen into a hole and I can't really find a program I'm having alot of faith in.

 

[Chromatinfish 123]

You should try a dedicated keylogger blocker.
I reccommend SpyShelter and Zemana Antilogger:

 

[hamo]

Emsisoft full Compatible with Zemana AntiLogger ( no reaction )

You can use Zemana AntiLogger seamlessly as an important extra layer of security, in harmony with almost any antivirus or firewall software.

See the list here : http://www.zemana.com/product/antilogger/overview/

Press

• 
  
  
  • Compatibility & Requirements

 

[XhenEd]

I think most antiviruses/antimalwares, if not all, white-listed Zemana's keylogger simulation test. So, don't lose faith if your antivirus/antimalware for not detecting and stopping the keylogger test.

I have ESET, but it doesn't block Zemana's simulation tests. Kaspersky doesn't block them either.

 

[Deleted member 178]

ZAL is whitelisted by most of Avs, if you want test it, maybe you can set EAM on paranoid

 

[Chromatinfish 123]

Can anybody verify if Zemana blocks SpyShelter's test and vice versa?

 

[rocky]

Thanks for the replies. I will install Zemana and give that a try. I appreciate the help!

 

[rocky]

I decided to give SpyShelter a try since I had never used it. It does block Zemana keylogger test. Thanks again for all the help!

 

[hamo]

Any one want key for ZEMANA , Just PM me .

 

[hamo]

What about activation of SpyShelter ?

 

[Myna]

Zemana Antilogger 1 year Key from this giveaway. Key was still working when I tried a couple of days ago.

Spoiler

5462-3476-1535-5617

Get extra 90 days validity:

1. Activate the above license.
2. Type TWTR and click Activate.
3. Spoiler

   
4. Follow the instruction.

Source: http://www.zemana.com/Promotions/AboutTwitterPromotion.aspx

 

[enaph]

What about activation of SpyShelter ?

SpyShleter is available as freeware for x86 systems:
http://www.spyshelter.com/spyshelter-free/
and it works perfect wiht EAM.

 

[Fabian Wosar]

Out of curiosity I tried to run Zemana keylogger simulator and it ran with no reaction from Emsisoft Anti-Malware so now I'm not sure what to think. I have fallen into a hole and I can't really find a program I'm having alot of faith in.

Emsisoft Anti-Malware is very focused on behavior blocking. Behavior blockers in general can't be tested with leak tests like the Zemana test for example. You could even argue that a detection of such tools by a behavior blocker is a false positive. While HIPS only care about whether or not a certain API was called or a certain action took place, behavior blockers care a lot about the circumstances and combinations of events.

From a behavior blocker's point of view the Zemana leak test is nothing like an actual keyloggers. To name just a few things:

1. A keylogger is usually invisible to the user. It doesn't have any GUI or a tray icon. The Zemana leak test though does have a GUI to display what was logged.
   
2. Keyloggers also usually install themselves in the system and make sure they run automatically during boot. This leak test on the other hand is just started by the user. It doesn't install itself and never adds itself to the autoruns.
3. Just collecting what you type alone is not very useful. Keyloggers always have mechanisms that allow them to save what you typed or to send out what you typed through the network. Leak tests usually don't do that.
4. Keylogger executables often "look" fishy. No icons, no version information, no digital signatures, usage of obfuscators and packers. Leak test executables on the other hand usually have a nice shiny icon, have proper version information and some leak test providers even signed their leak test.

So when a behavior blocker sees the Zemana leak test call the SetWindowsHookEx API for example to install a window message hook it will notice that the application has the capability of logging keys, but all other aspects of the application point toward it being legitimate and not a keylogger, so it may decide not to issue an alert about it just yet.

 

[Tony Cole]

Fabian when will Emsisoft Internet Security 9 be released?

 

[Fabian Wosar]

Fabian when will Emsisoft Internet Security 9 be released?

When it is done. There is no ETA yet. We just know that it doesn't meet our own quality standards yet and we won't release it before they are met.

 

[Deleted member 21043]

Emsisoft Anti-Malware is very focused on behavior blocking. Behavior blockers in general can't be tested with leak tests like the Zemana test for example. You could even argue that a detection of such tools by a behavior blocker is a false positive. While HIPS only care about whether or not a certain API was called or a certain action took place, behavior blockers care a lot about the circumstances and combinations of events.

From a behavior blocker's point of view the Zemana leak test is nothing like an actual keyloggers. To name just a few things:

1. A keylogger is usually invisible to the user. It doesn't have any GUI or a tray icon. The Zemana leak test though does have a GUI to display what was logged.
   
2. Keyloggers also usually install themselves in the system and make sure they run automatically during boot. This leak test on the other hand is just started by the user. It doesn't install itself and never adds itself to the autoruns.
3. Just collecting what you type alone is not very useful. Keyloggers always have mechanisms that allow them to save what you typed or to send out what you typed through the network. Leak tests usually don't do that.
4. Keylogger executables often "look" fishy. No icons, no version information, no digital signatures, usage of obfuscators and packers. Leak test executables on the other hand usually have a nice shiny icon, have proper version information and some leak test providers even signed their leak test.

So when a behavior blocker sees the Zemana leak test call the SetWindowsHookEx API for example to install a window message hook it will notice that the application has the capability of logging keys, but all other aspects of the application point toward it being legitimate and not a keylogger, so it may decide not to issue an alert about it just yet.

Your behavior blocker is amazing. I wish I could make one like yours aha Of course that isn't going to happen with me using .NET... Of course I will need C...

 

[Fabian Wosar]

Your behavior blocker is amazing.

It gets the job done but there is plenty of room for improvements. We have our work cut out for us.

 

[Lailson]

Fleeing a little of the subject @Fabian Wosar
Please could you take a look at this topic that I voluntarily translated the sentences that were missing for my language in the forum Emsisoft will have one month and I do not got answer yet:
http://support.emsisoft.com/topic/9399-portuguese-pt-br/
Thank you

 

[Fabian Wosar]

I will ask Frank to take care of it.

 

[Tony Cole]

Fabian thanks for the reply! It's truly an amazing product; that offers excellent protection.