Advice Request Emsisoft static detection - is it getting worse?

Please provide comments and solutions that are helpful to the author of this topic.

Status
Not open for further replies.
H

hjlbx

I don't worry at all, as I said before, with good browsing habits and not opening everything unknown (or, if really interested in / needed, not without some VT check and at best in a safe environment) you should be quite safe with Emsisoft. You can also try to max out the settings for personal use.

However, I can't let the comments above unanswered as it is also me stating the Emsisoft results in the HUB, which have been "infected" quite some times in the past, see spoilers in the post for in-depth details.

I don't know why Emsisoft does not have setting "Block execution of any program that is not specifically whitelisted in the Emsisoft AntiMalware Network."

Similar setting is in Webroot for its cloud and acts as a pseudo-anti-executable.

As a closed-beta tester I asked for it, but it was rejected by Emsisoft. They consider things carefully, so there must be some reason - but they didn't state what.
 
Last edited by a moderator:

Der.Reisende

Level 45
Honorary Member
Top Poster
Content Creator
Malware Hunter
Dec 27, 2014
3,423
I don't know why Emsisoft does not have setting "Block execution of any program that is not specifically whitelisted in the Emsisoft AntiMalware Network."

Same setting is in Webroot and acts as a pseudo-anti-executable.

As a closed-beta tester I asked for it, but it was rejected by Emsisoft. They consider things carefully, so there must be some reason - but they didn't state what.
Ok, thank you for letting us know!
Maybe they thought unexperienced users (I don't intend to rate anybody!) would accidently activate that and lose comfort by that.

I'm already about to leave, had only a few minutes at home, I found one setting that could get in the direction you state, but probably still needs at least some suspicious activity to work properly.

EDIT: Note that this is no stock setting, but needs to set custom by the user.

Let's see whether something changed in v12, I haven't tried to BETA yet, waiting for the stable.

emsi.JPG
 
Last edited:

adnage19

Level 5
Verified
Well-known
Sep 22, 2016
211
I want to add that recent poor detection ratio is not strictly Emsisoft's fault, just Bindefender signatures catch new malware too slow. When you look at the malware hub samples and VT analyse links, you will see that Bitdefender actually never detect these samples. AVs like ESET, Kaspersky or Avira just kick Bitdefender's butt :D
 

Solarquest

Moderator
Verified
Staff Member
Malware Hunter
Well-known
Jul 22, 2014
2,525
I'm using and testing Emsisoft since some tome and agree with the comments above.
Emsisoft's static detection is not as good as it was in the past and in my opinion other AV are better in adding signatures right now.
This is because Emsi uses Bitdefender's engine and signatures too, and Bitdefender is not having his best tome with signatures updates.
As already pointed out, this might, and probably will, change in the future.
Test in the Hub forum has to be analyzed with attention: how fast after posting were samples tested?
What was detected? Why was system declared as infected? Were files encrypted or is malware in memory? How good was BB detection?
Emsi as many other AV doesn't rely only on signatures anymore to detect malware: heuristic, BB, Hips, cloud are the last line of defebce, the one that will/should detect new/still unknown malware.
According to official as hub tests, only few AV really have working BB (see av-comparatives real world tests)...Emsi, Bitdefender, Kaspersky, Avast are some of them.
Considering the wholy picture (static +"dynamic" detecyion) Emsi still provides a great protection and version 12 seems to be better than 11 (BB is now better at blocking and deleting detected malware).
I tuned up Emsisoft by deselecting the option to check only files with specific extensions.

On the other side, I believe nowaday no AV alone can protect you from malware, mostly if you are a "heavy clicker" and go "where you shouldn't".
Adblocker, anti-exploit, anti-exe are recommended add-ons as always updated programs, backups..... use of sandbox or VM programs adds additional security against unwanted changes to your system.
 
D

Deleted member 2913

I don't know why Emsisoft does not have setting "Block execution of any program that is not specifically whitelisted in the Emsisoft AntiMalware Network."

Similar setting is in Webroot for its cloud and acts as a pseudo-anti-executable.

As a closed-beta tester I asked for it, but it was rejected by Emsisoft. They consider things carefully, so there must be some reason - but they didn't state what.
If Webroot option that acts as a pseudo-anti-executable is enabled...how it works?

I have tried Webroot but dont remember such option...whats the option?
 
H

hjlbx

If Webroot option that acts as a pseudo-anti-executable is enabled...how it works?

I have tried Webroot but dont remember such option...whats the option?

Heuristics > Block any program that is not specifically whitelisted

Emsisoft now has setting to quarantine a file if it cannot be verified in EAN and acts suspiciously

I just looked at EIS 12 - there's a lot of improvements; it is even better than when I used 9 and 10
 

SHvFl

Level 35
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Nov 19, 2014
2,346
Heuristics > Block any program that is not specifically whitelisted

Emsisoft now has setting to quarantine a file if it cannot be verified in EAN and acts suspiciously

I just looked at EIS 12 - there's a lot of improvements; it is even better than when I used 9 and 10
Hmm i am testing EAM and can't see it so maybe it's just EIS? Can you point where the setting is please?
 

dmzbg79

Level 24
Verified
Top Poster
Well-known
Oct 28, 2014
1,339
Well,the static detection is getting worse,because Emsisoft are relying on their Bitdefender engine...And the signature detection of Bitdefender is getting worse...I just tested Bitdefender Internet Security 2017 in the Malware Hub and not surprisingly the static scan did not detect any of the 7 files...It only removed 5 of them when i started the exe. files,thanks to the Active Threat Control...The problem that other programs using the Bitdefender engine is that they get help only with signatures...And the Bitdefender signatures are getting worse...
 
D

Deleted member 2913

Heuristics > Block any program that is not specifically whitelisted

Emsisoft now has setting to quarantine a file if it cannot be verified in EAN and acts suspiciously

I just looked at EIS 12 - there's a lot of improvements; it is even better than when I used 9 and 10
How the Webroot option works?
I mean if enabled do we get alerts allow/block for unknown?
 
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top