App Review Emsisoft Anti-Malware vs FCrypt ransomware (Juan Diaz)

[Andrew999]

Content source

https://www.youtube.com/channel/UCbjRDDLzQ6jLYBrU0BPGbrA

To be honest, I've heard from quite a few people that Emsisoft has been going downhill lately. I personally think that is the case too after seeing some videos. About 2 years ago it was so great. Nothing could get past it basically!

Lots of people swear by Kaspersky. I personally love Kaspersky, but I have been using NANO Antivirus for about at least 6 months and am loving using it.

 

[ForgottenSeer 72227]

Well to be fair nothing is ever perfect. Despite the fact that people say that nothing is 100% perfect, it still kinda fascinates me when people act surprised when a product missed something, or failed a test. I'm not making excuses for Emsisoft, personally I still think it's a great product, with very good protection, however, no matter what you use, you still always need to practice basic security 101. When it comes to ransomware, the only and I mean the ONLY 100% guaranteed protection from any type of ransomware is to simply backup. It's the only guaranteed protection against this type of thing. Look at Wanacry and how it got past so many products initially, what about the new Asus security fiasco?

Over the last 4-5 months I've seen various tests posted here, from all sorts of products and them missing stuff. All this does is reinforce the point that every product can miss malware and every product can fail at some point. IMHO we need to stop looking for something that will offer 100% protection every time, it's not available, nor will it ever be. At the end of the day, use which ever program you like most and be sure to practice good security hygiene and chances are you will be more than fine.

 

[Mahesh Sudula]

The point in any tests i or anyone does is just for simulation analysis, where it is operated under high tough conditions.
this only projects how av behaves under that specific interval with that sample
Even though AV Misses on execution ..but well may block it through web shield..which are not considered in this phase. Real world tests doesn't consider normal user.
By the normal user gets it, yay ! a signature would definetly be there !

 

[ForgottenSeer 72227]

The point in any tests i or anyone does is just for simulation analysis, where it is operated under high tough conditions.
this only projects how av behaves under that specific interval with that sample
Even though AV Misses on execution ..but well may block it through web shield..which are not considered in this phase. Real world tests doesn't consider normal user.
By the normal user gets it, yay ! a signature would definetly be there !

Very good points!

Tests in general are very difficult to represent what really going on in the real world. Like you said, many of these tests ignore things like web protection that may or may not have stopped it, but it's still one piece of the whole concept. IMHO tests in general should be taken with a grain of salt. I'm not saying to ignore them completely, but to simply realize that they often don't represent what happening in the real world. Despite what may of these tests say, overall the vast majority of products offer very good protection, including WD. At this point we are really just splitting hairs, and IMHO trying to decide which product to use based on these tests and tests in general is not a good idea. You will constantly be chasing perfection when it's not there.

As I always say, there are many other reasons to choose a product (performance, UI, settings, privacy, etc...). There's no such thing as a perfect product and everyone just needs to use the trial periods and try them for themselves in order to come to the conclusion on which one they like the most.

 

[Dhruv2193]

No solution can protect you 100%. kaspersky is also one of the top products and so is Emsisoft. Emsisoft is better than kaspersky in detecting PUP's and adware and in 1-2 tests i have seen it detect more malicious threats than kaspersky. Sometimes kaspersky will win sometimes emsisoft and sometimes tie.

 

[Fabian Wosar]

Hasn't this video been posted before? Anyway: In general I can probably pull out hundreds of samples per day that each given solution doesn't detect. That may sound horrible, but given that those are from 400k a day puts things into perspective.

We do miss samples occasionally, yes. Every single solution does. Some of that is in public tests, others are on actual user systems (which is the worst case scenario for us and is thankfully exceedingly rare), and others we notice during our normal in-house sample testing. Trying to find any kind of pattern ("this product is getting bad!") based on limited insights into some of those misses is kind of silly. I would even take official tests with some grain of salt. I mean, we literally throw tens of thousands of dollars at testing labs each year and even I can't tell you what exactly is contained in those test sets. We will only ever see the samples we missed. But there is almost no transparency into where these samples are from, how they were obtained, whether those are actually different malware families or just hundreds of the same family, or how any particular sample ended up there.

One particular case to give you an idea was one particular VB test, where we ended up missing like over a thousand samples. That looked obviously pretty bad. Turned out, all those 1000 samples was the same virus that had infected over a thousand different files, which all somehow made it into the test set. So a product that missed two samples, may have been worse than us, even though we missed over a thousand.

So while I appreciate people's efforts to make these videos (I actually enjoy watching them a lot, it's a guilty pleasure of mine), it's just one isolated data point in a vast sea of millions of data points collected all over the place.

In my experience, and feel free to dismiss this if you wish, the best long-term indicator is looking into tech communities. Places like here or BleepingComputer or GeeksToGo or Trojaner-Board. Places where victims of malware show up. Then see what kind of products they use. You will see users of certain products showing up there quite regularly, while others don't, even though both products have comparable market shares. That's like the closest you can get to real life performance insights.