Advice Request I am head of research at Emsisoft. Ask me anything! :)

[Nightwalker]

@Fabian Wosar

Consider releasing a Free Anti Virus truly free in the sense that except for security no other tracking from its users and market it heavily that way that a free AV that doesn't make money by using it. Releasing free anti virus improves brand awareness tremendously.

I dont think that Emsisoft can afford to offer a free real time antivirus without compromissing its users privacy and the company core values.

Kaspersky can do it because they are huge in the corporate market and the free antivirus offer helps with telemetry, Avast/AVG/Avira can do it because they sell its user data and so on ...

 

[g4nu5]

how to join to your team ? or not

 

[ForgottenSeer 72227]

I dont think that Emsisoft can afford to offer a free real time antivirus without compromissing its users privacy and the company core values.

Kaspersky can do it because they are huge in the corporate market and the free antivirus offer helps with telemetry, Avast/AVG/Avira can do it because they sell its user data and so on ...

I agree!

I don't want anyone to take this the wrong way, I mean this in the friendliness of ways, but I think we need to stop asking @Fabian Wosar and Emsisoft to make a free version. @Fabian Wosar has already kindly addressed this question a few times, so constantly asking him/Emsisoft is not going to change their stance. He has already explained that while they would like to offer a free version, as of right now they aren't able to, unless they start doing things like harvesting and selling people's data. He has also said that if they are able to ever find a way to offer a free version without having to harvest/sell data, or have ad's, etc..., they may consider it. Until then it will not be free, but it may never happen.

I know that's not what some people may like to hear, but at the end of the day, not everything in life can be free. As @Nightwalker as has already said, other companies can do this because:

a. They have a very large enterprise presence, so they have a lot of income coming in via other means. It's no different than Microsoft. They can offer Windows for personal use very cheaply and offer a lot of services for free (ie: outlook.com, one drive, etc...), because MS makes a HUGE portion of their money through selling Windows, Office, WD ATP, etc... to their businesses and enterprise customers.

b: They harvest and sell your data. Nothing is ever truly free, you are just paying for it another way (ie Avast/AVG).

Again I get it that people aren't able to purchase some of these products and that is very understandable, I am in no way questioning that at all, but we also have to keep in mind that just because some companies can do it, others may not. Emsisoft could easily make a free version, but if it means that they have to either close down shop because they aren't making any money, or they do away with their excellent privacy commitments, then personally I think we lose what a great company/product Emsisoft is currently.

Personally as much as I would like to see a free version, I understand where Emsisoft is coming from and quite frankly I love the company's core values (excellent customer service, always putting customer privacy first, etc...) and I don't want them to ever do away with that just to make a free version. It's one of the many thing IMHO that makes Emsisoft stand out from the others.

 

[Fabian Wosar]

I still ask why can't users opt out on the point of payment/page (see screenshot) where users are told this is auto-renewal/subscription (a big box) & opt of this yet still buy? Rocket science? No - I won’t comment on this again - It starts of as for me a 2-year 3 user product & on the next page is a subscription? As I've said before it's your company? BTW the use of bold type changes nothing.

People often accuse us of doing decisions without reason. The opposite is the case actually. Our decisions are incredibly data-driven. Whenever something changes on the website, it is usually the result of months of A/B testing. A/B testing means, that for a time, we have multiple versions of the same webpage online. Users visiting the website get one of those different versions randomly assigned. We have multiple goals defined for each test run and measure which of those versions is more successful.

As Christian mentioned, we performed an exhaustive test of the ordering process, with many different variations. This testing went on for literally months with hundreds of thousands of data points to make sure the results we got were reliable.

We experimented with no subscription, optional subscription with subscription turned off, optional subscription with subscription turned on, as well as an automatic subscription with the ability to opt out after the purchase process.

The option that performed the best by a significant margin was the latter. So that's the reason why there is no option. Because we did extensive A/B testing of all the options available and an automatic subscription works the best for our users. That may not be an answer you like, but it is ultimately the reason why.

when does Emsi get samples from VT?

In real-time. It's actually one of the reasons why submitting samples to VT before you test it at the Malware Hub is kind of a bad idea. There are a lot of AVs out there that will blindly copy VT results without further thoughts, so you hand them all your samples before you test them pretty much, guaranteeing 100% detection.

does it help to submit malware that Emsi does not detect on VT nor with EAM on a pc or did Emsi already get it from VT (e.g if other AV already detect it)?

There are different piles of samples. Submitting them to us directly will get human attention and may lead to a more high quality detection/signature while submitting through VT will get it processed automatically by our automated systems.

how is Emsi scanner on VT compared to EAM?

They use the command line scanner that is also available on our website. They do use their own update mechanism though, which sometimes causes issues. Essentially what they do is they have one server they run the different vendor updates on and then replicate those using their own mechanism to all their scan slaves.

how often do you update BB rules?

Depends on what kind of rules. At the moment there are two bits and pieces to the rules. There are local rules, which are part of a2core.dll and a2hooks.dll, which are updated about once a month and then there are rules in the backend, which are updated constantly (usually multiple times per second).

in a previous answer you said that "If malware is vm-aware, I just patch the checks out"...can you make an example?

Sure, I will show you in a moment.

how does Emsi handle malware with valid signature? Does BB still monitor them?

We use statistical methods to figure out and detect compromised certificates. That means, there may be some "patient zeroes" until the model collected enough data to blacklist the certificate. Especially recently there has been a surge in signed malware, so we are considering switching the model to distrust any certificate until proven trustworthy instead of the other way around.

How does EAM BB deal wtih the whitelist bypass (eg. a malicious .dll was loaded by a whitelist program( not signed malware))? Does BB auto allow/trust its behaviors or not?

Binary planting is an issue, yes. In the current trust model, it may be trusted until the certificate was revoked automatically by our backend systems.

I always use virtual credit card (entropay or skrill) for online shoping. Even if you forget about auto renewal, they can't get your money

That's a good habit actually. My bank offers the same and so do a lot of different payment services like Paypal for example, where you can cancel the authorisation unilaterally.

Consider releasing a Free Anti Virus truly free in the sense that except for security no other tracking from its users and market it heavily that way that a free AV that doesn't make money by using it. Releasing free anti virus improves brand awareness tremendously.

Unless you are a lifestyle brand, brand awareness doesn't pay rent or put food on our developer's tables.

how to join to your team ? or not

You can check out our job listings here:

Emsisoft - Careers

Work from the comfort of your home while helping protect the digital lives with a career at Emsisoft - a truly virtual company.

www.emsisoft.com

 

[Nightwalker]

In real-time. It's actually one of the reasons why submitting samples to VT before you test it at the Malware Hub is kind of a bad idea. There are a lot of AVs out there that will blindly copy VT results without further thoughts, so you hand them all your samples before you test them pretty much, guaranteeing 100% detection.

Yeah pretty much this, I noticed that some time ago, it is so disappointing to see how the vast majority solutions just flags everything that some major players detects as malware in Virustotal without real "research".

Advice Request - I am very disappointed by some antivirus solutions [copycats]

Guys, today I was just doing some tests with Windows Defender Testground website and I realized how mediocre some antivirus solutions actually are; let me explain below. In this website there are some files to test if Windows Defender protection is working correctly. So I tried the CloudBlock...

malwaretips.com

There are very few security vendors that deserves our money and I have to say, without being a apple polisher, that Emsisoft is one of those few companies.

 

[Andy Ful]

Don't worry about it. Everyone has to start somewhere and I prefer asking questions and making sure you got it right over making incorrect assumptions.


A lot of people have like really wrong impressions of how signatures are generated and what they actually are. So glad to give you some insights.


It's doable and it is needed. Especially for stuff like VBS, VBA, JScript and Powershell. It's actually quite interesting, as a lot of "Next-Gen AV" handle these vectors poorly, if at all. Especially when it comes to attacking company networks, you often see that attackers don't use classic malware at all. Everything is done through Powershell.

What do you think about an option to restrict or block Windows scripts (VBS, VBA, JScript/JavaScript, and Powershell) when run by the user (with medium integrity level). Some MT members would prefer this in the home environment. There are not many applications which use Windows scripts.

 

[Fabian Wosar]

What do you think about an option to restrict or block Windows scripts (VBS, VBA, JScript/JavaScript, and Powershell) when run by the user (with medium integrity level). Some MT members would prefer this in the home environment. There are not many applications which use Windows scripts.

May work for you guys, but not for home users. You have to keep in mind: The user already decided they want to open the script at that point because they decided that file was legit and it contains an important invoice, delivery notification, celebrity nudes or whatever. So they won't be stopped by an application asking them if they REALLY want to open it.

 

[Andy Ful]

May work for you guys, but not for home users. You have to keep in mind: The user already decided they want to open the script at that point because they decided that file was legit and it contains an important invoice, delivery notification, celebrity nudes or whatever. So they won't be stopped by an application asking them if they REALLY want to open it.

That is true for motivated home users (I know some personally), but most of home users open scripts by an accident, because they are fooled by the embedded icon, or another trick. Many home users do not touch AV settings, at all. Such option would be especially useful for children or computer illiterate users. There are many families where one person has above average knowledge about computers. Such a person could configure restricting/blocking scripts in AV.

 

[Fabian Wosar]

Scripts come as normal attachments to emails or embedded into Office documents in almost all cases. There is no trickery involved. The only trickery is that they have been told it's something important or something of interest to them. Here is what happens every single time for the vast majority of home users:

1. They decide they want to do something (like open that important invoice).
2. There is an AV/HIPS/Anti-Executable popup.
3. They may be cautious and block.
4. Stuff doesn't work, but that invoice is important!
5. So they try again to do what they decided they want to do earlier.
6. They pick the other option this time because otherwise, it won't work.

The culmination of this is that a lot of popups literally train people to ignore them and just click allow because otherwise whatever they want to do doesn't work.

These systems aren't fit for general purpose. They are fit for knowledgeable users. Although you can argue that for a knowledgeable user, who is capable of making the right decision every single time, these kinds of alerts are completely superfluous as they won't double click a script contained in a ZIP archive attached to a fake UPS email, to begin with.

 

[SumTingWong]

Started when I was 11. I didn't start with comp sci though. Just started with programming and being interested in computers in general.


I am definitely not a king. There are plenty of much more talented people out there. There is a lot of practice involved, yes. But it never felt like work since I loved doing it. It helps that I have kind of an obsessive personality. I get really into things and don't stop pursuing them no matter how boring people find it.


First time I saw a PC was at 7. My dad did some educational courses as he was unemployed and at least in Germany when there is little chance for you to get a job in what you previously did your apprenticeship/education in, they try to teach you new stuff to get you into other jobs. I visited him a few times at his school and they had PCs there. It was clear that I wanted one, but my family was incredibly poor. Plus I grew up in the GDR. So PCs weren't that common, to begin with. I spent the next 4 years with saving money. Like I collected bottles on the street, saved my allowance, did anything a small kid can do really to get a bit of money.
At 10/11 I bought my first PC. I was so happy. It was a pretty decent one as well for the time and served me well for the next 6 years or so. It didn't take long until I was infected by a virus though (Tequila.B). I got it from a game I copied from a school friend most likely. Back then it was normal to just trade floppies on the school campus.
I didn't know what to do so my first reaction was to just go to the local library and look up computer viruses. To my surprise, they actually had a couple of books there for me to read. So I did that. It became obvious quickly that I would need to learn assembly to truly understand what was going on. So I did that. Bought a book about assembly and wrote my first little tool to clean up my messed up files.
Assembly was nice, but it was kind of tedious to write programs in. So I asked my school's computer science teacher what he would suggest. I literally dumped all kinds of questions on him actually, none of which he could answer. I really struggled with pointer arithmetic for example, but I really wanted to write a memory scanner. But he recommended Pascal to me. So when I was 12 I started to learn Pascal.
From Pascal the natural transition was to Delphi which I used almost exclusively and still do from time to time. On the road, I picked up C (which I thought was stupid in the beginning, as I had an irrational hatred for curly braces), then later C++. Then came the transition to Windows 95 and my interest in that.


Stubbornness. The same kind of attributes that get me regularly into trouble with people in real life.


For malware research there are a lot of great resources now, that didn't exist before. OpenSecurityTraining is a good one. MalwareUnicorn has a nice tutorial for basics as well. There are some amazing books as well. I can recommend these:

Amazon.com: Low-Level Programming: C, Assembly, and Program Execution on Intel® 64 Architecture eBook : Zhirkov, Igor: Books

Buy Low-Level Programming: C, Assembly, and Program Execution on Intel® 64 Architecture: Read Books Reviews - Amazon.com

www.amazon.com

Amazon.com: C++ Primer (5th Edition): 9780321714114: Lippman, Stanley, Lajoie, Josée, Moo, Barbara: Books

Amazon.com: C++ Primer (5th Edition): 9780321714114: Lippman, Stanley, Lajoie, Josée, Moo, Barbara: Books

www.amazon.com

Pretty much everything related to C++ written by Bjarne Stroustrup, Herb Sutter, Scott Moyer and Andrei Alexandrescu.

Malware and reverse engineering specifically:

Art of Computer Virus Research and Defense, The: Szor, Peter: 9780321304544: Amazon.com: Books

Buy Art of Computer Virus Research and Defense, The on Amazon.com ✓ FREE SHIPPING on qualified orders

www.amazon.com

Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation: 9781118787311: Computer Science Books @ Amazon.com

Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation: 9781118787311: Computer Science Books @ Amazon.com

www.amazon.com

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software: Sikorski, Michael, Honig, Andrew: 8601400885581: Amazon.com: Books

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software [Sikorski, Michael, Honig, Andrew] on Amazon.com. *FREE* shipping on qualifying offers. Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software

www.amazon.com

I would start with C. From there transition to C++. Don't bother learning old C or C++ standards. They will only teach you bad habits. If your book/material starts to tell you to use new and delete for memory management, toss it and get a better one. Modern C++ (starting with the C++11 standard) is one of the most beautiful and expressive languages there is. Also Python is incredibly useful as well.


I wouldn't rule it out, but probably not for a while.


Can't talk about it yet. But it is a valuable feature.


You will see.


They require certain groundwork that isn't in yet, because it is specific to Windows 8/10 only and we still need to support Windows 7.


Security theatre. Only reliable way is sticker or some kind of cap to put over your webcam.



Download wrappers
A download wrapper is an installation program that is wrapped around the actual program a user wants to install. It often contains sponsor offers which are optional, but often presented in such a way that a user is persuaded to install these additional features.
Download wrappers will be detected when one or more of the following conditions are true:

• There is no (clear) link to, or description of the EULA and/or Privacy Policy of the product(s) presented before the installation starts.
• There is no (clear) option to decline the installation of sponsor applications/features present or the way this option is presented is misleading or third-party options are prechecked.
• During installation the browser settings (e.g. homepage, search settings) are modified without user consent and/or notification.
• Sponsor applications/settings are installed/changed without user consent.
• The included application(s) does not have an uninstall option.

Toolbars/Browser Helper Objects/Browser Extesions
A toolbar/BHO/Extension is an addition to an internet browser that can have a variety of functions. They will be detected when one or more of the following conditions are true:

• (One of) the objective(s) of the toolbar/BHO/extension is to track personal data and/or transmit this to third parties without sufficiently informing the computer user about this.
• There is no (clear) link to, or description of the EULA and/or Privacy Policy of the toolbar/BHO presented before the installation starts.
• During installation the browser settings (e.g. homepage, search settings) are modified without user consent and/or notification outside the scope of the toolbar/BHO.
• The toolbar/BHO/extension is installed silently (without asking for user consent).
• The toolbar/BHO/extension does not have an uninstall option.

PC Optimizers
PC Optimizers are applications that pretend to scan for problems on a computer (this can be malicious content, outdated drivers, performance issues and so on). This type of program will be detected when one or more of the following conditions are true:

• The application presents fake or non-existent threat detections and removal or does not present details about found objects.
• The application is installed without user consent.
• The application does not have an uninstall possibility.
• The application presents alerts/pop ups meant to scare the user into purchasing the product without such alerts being warranted by the severity of the found issue(s).
• The program is not able to address detected problems but requests payment to unlock this feature nonetheless even though no form of trial is available.

Risktools
Risktools are applications that provide a functionality that in itself is non-malicious but can be used by third-parties to conduct malicious activities. Applications will be detected when one or more of the following conditions are true:

• The application facilitates the monitoring/capture of networks or network traffic.
• The application facilitates the monitoring/capture of text input.
• The application facilitates modification of access levels/policies on a computer in an insecure manner.

Remote administration tools

• Remote administration tools are applications that can be used to access a computer from a remote location. This type of application is detected when one or more of the following conditions are true:
• The application allows a connection from/to a remote computer insecurely and/or without requiring consent/authentication from the (remote) user.
• The application is installed silently (without asking for user consent).

In general, we allow our analysts certain freedoms and to use their common sense though. These standards are also regularly updated.


The behaviour blocker is able to detect a whole bunch of them. But especially removal is heavily driven by signatures.


Mostly because especially enterprises don't want their users to use cracks/pirated software.

So modern C language programming and not the old one?

 

[oldschool]

The culmination of this is that a lot of popups literally train people to ignore them and just click allow

This is called "security fatigue", which subject I am surprised is not discussed much (or at all) on security forums. This is probably the biggest issue (aside from lack of PC skill/experience) that the average user faces. This is also why a set and forget AV is ideal for them. It may not protect them from all infection, but it will protect them against security fatigue - which, as you point out, is a cause.

This is casually overlooked or avoided with forum talk about this or that app, with its myriad of notifications.

 

[vaccineboy]

Sorry if this is already been asked: Some says Windows 10 Defender eliminates the need for third party solution, even as far as the days of third parties are numbered. What is your take? In other words, what is the advantage you have over the built-in one?
Thanks.

 

[Andy Ful]

Scripts come as normal attachments to emails or embedded into Office documents in almost all cases. There is no trickery involved. The only trickery is that they have been told it's something important or something of interest to them. Here is what happens every single time for the vast majority of home users:

1. They decide they want to do something (like open that important invoice).
2. There is an AV/HIPS/Anti-Executable popup.
3. They may be cautious and block.
4. Stuff doesn't work, but that invoice is important!
5. So they try again to do what they decided they want to do earlier.
6. They pick the other option this time because otherwise, it won't work.

The culmination of this is that a lot of popups literally train people to ignore them and just click allow because otherwise whatever they want to do doesn't work.

These systems aren't fit for general purpose. They are fit for knowledgeable users. Although you can argue that for a knowledgeable user, who is capable of making the right decision every single time, these kinds of alerts are completely superfluous as they won't double click a script contained in a ZIP archive attached to a fake UPS email, to begin with.

You probably noticed a loophole in such reasoning.
All points mentioned by you are valid also for any file - for EXE files, too.
It is true that if the user is motivated to run something, then he/she do it anyway, and can be infected. But, AVs are still installed on computers, so they are probably for some other reasons. Most children and computer illiterate users do not see any difference between files they open/play/run. Furthermore, in the case of scripts, the issue can be solved easier than in the case of EXEs, because the scripts in the home environment can be restricted/blocked silently.

 

[Fabian Wosar]

So modern C language programming and not the old one?

Modern C and C++ standards, yes.

This is casually overlooked or avoided with forum talk about this or that app, with its myriad of notifications.

It's the reason why we changed most of the defaults.

Sorry if this is already been asked: Some says Windows 10 Defender eliminates the need for third party solution, even as far as the days of third parties are numbered. What is your take? In other words, what is the advantage you have over the built-in one?Thanks.

If you ever tried to contact Microsoft looking for help for literally anything, you will be able to answer that question yourself. Despite that, I was always wondering: Literally like half the time Smart Screen, for example, seems to be down for me. I get messages "Oh, we can't reach the cloud. Do you want to run this anyway?". Not sure if that's a thing with my internet connection or a general observation. Since I did have that behaviour with different internet connections, I am leaning towards the later.

Windows Defender is also one of the slowest products out there, which is kind of baffling giving that Microsoft can and indeed did create special APIs and mechanisms just for them.

You probably noticed a loophole in such reasoning.
All points mentioned by you are valid also for any file - for EXE files, too.

Obviously. But there is a difference between an alert: "Do you really want to run this?" and "Listen, this thing is a virus. I put it in quarantine.".

It is true that if the user is motivated to run something, then he/she do it anyway, and can be infected.

How do you think so many people catch ransomware, even ancient well detected ones, that are spread through pirated software? Is it particularly sophisticated? No. Is it using some ultra-secret obfuscation technique that prevents the ransomware from staying undetected for months? No. It's the user who throws caution out of the window because they really want to play Call of Duty right now!

But, AVs are still installed on computers, so they are probably for some other reasons. Most children and computer illiterate users do not see any difference between files they open/play/run.

AVs usually don't ask "Do you want to run this?". They just take care of it. Big difference.

Furthermore, in the case of scripts, the issue can be solved easier than in the case of EXEs, because the scripts in the home environment can be restricted/blocked silently.

I think you greatly underestimate the prevalence of scripts in a home environment. In fact, Windows ships quite a few scripts that are enabled by default to run for maintenance tasks. A lot of installers and updaters will run scripts automatically in the background to do things. Some developers are just outright stupid and run cmd.exe just to copy files because using the CopyFile API would be too easy.

 

[Xtwillight]

To be clear on that: We don't want to trick anyone into payments that they don't want. With the Emsisoft auto-renewal there are literally no strings attached.

As per the Pricing page FAQ at the bottom (Emsisoft | Buy Anti-Malware Software):

What does Auto-Renewal mean?

Auto-renewal ensures you don't end up defenseless when your license period runs out. When your license is about to expire, our online payment provider verifies that your payment details are still valid and automatically renews your subscription when the license ends. Please note that you can cancel auto-renewal at any time with just one click via the order confirmation email or directly on the purchase confirmation page after completing your order. We're certainly not interested in charging any money if you don't want to use our products and always offer a full refund for any unwanted transactions within 30 days.

In other words: You can cancel your subscription at various points:

• At the end of the purchase process on the confirmation page there is a large center screen 'Cancel subscription' button.
• In the purchase confirmation email the same again.
• You can drop us an email or reach out to our live chat and ask for a cancellation.
• Even in case you missed to cancel and see an unwanted charge on your card/paypal, just drop us a note within 30 days and we'll refund the full amount.
• If you request a refund later than 30 days, we offer a partial refund depending on the time left on the license.

The reason why we completely switched to auto-renewal payments is that it's more convenient for users who don't want to bother with the purchase process every year. We ran a test to see how well subscriptions are perceived and even to our surprise we figured that our new sales rate increased (!) by making auto-renewal the only available option.

Sorry, there are users and customers who see it differently !

1) With the newly introduced order process
it is an order that has been
is initially bound to a subscription !
This means that each customer with an order
this subscription as automatic order process for the first time
if he wants to buy Emsisoft Antimalware .
And so it is based on the definition a subscription

2) Even if Emsisoft wants to make it as easy as possible for their buyers to cancel the subscription after the actual order process.
*By clicking on the link after the order confirmation
*By the support

3)Quote "The reason why we completely switched to automatic extension of payments is that it is more convenient for users who do not want to bother with the purchase process every year. We ran a test to see how well the subscriptions are perceived and even to our surprise we found that our new sales rate rose (!) due to the automatic renewal the only option available.".

That's the best answer ever,
The customer who does not want a subscription by default,
must take at least one step more than a customer
who wants a subscription .
So it will be for all customers who do not want a subscription
more uncomfortable !

This discussion was also partly held in the Emsisoft Support Forum with Thomas Ott.

Only there is no satisfying answer for the customers.
which initially binds the order process to a subscription
not want .

 

[Fabian Wosar]

Sorry, there are users and customers who see it differently!

There are always customers and users who see it differently. We do these test runs to see what the general consensus is.

Sorry, there are users and customers who see it differently!
1) With the newly introduced order process
it is an order that has been
is initially bound to a subscription !
This means that each customer with an order
this subscription as automatic order process for the first time
if he wants to buy Emsisoft Antimalware .
And so it is based on the definition a subscription

We already see Emsisoft Anti-Malware as a service. Moving to a subscription and therefore a true software-as-a-service concept is a very logical step in that context. I wouldn't be surprised if we offered monthly subscriptions at one point that you can cancel whenever you want.

That's the best answer ever,
The customer who does not want a subscription by default,
must take at least one step more than a customer
who wants a subscription .
So it will be for all customers who do not want a subscription
more uncomfortable !

And the other way around the customer who wants a subscription must take at least one more step than the customer who doesn't. Which of those two customer groups is right? The way to quantify that is to test and figure out what the majority of your customers want. Again, we did the research on this using extensive A/B testing over 3+ months.

For us, sales conversion with an automatic subscription is by far the highest compared to literally any other option (no subscription, optional subscription with default on, optional subscription with default off, automatic subscription) and therefore the option that harmonizes the most with our general customer base. It may not harmonize with you and that is completely fine. Being a company is full of compromises like this. In the end, it's one additional click at the end of ordering to cancel compared to one additional click if it was an option right during the ordering process to unselect it.

 

[Andy Ful]

Fabian Wosar
Please do not get me wrong. I read many of your posts, and I can recognize a knowledgeable professional. I post here not to say that EAM is not good. I like the Emsisoft products since Mamutu BB. But generally, I do not get why the user cannot choose the option to block scripts, if he wants. Furthermore, the script issue is rather the general problem not related to EAM.

...
AVs usually don't ask "Do you want to run this?". They just take care of it. Big difference.
...

So why do not care about scripts? Oh, wait! AVs cannot do it properly, so let's allow scripts to run, and block an EXE payload. Hmm, but the payload is often fresh malware and the detection of such malware is poor, even with a good BB.
So, maybe restrict/block scripts, anyway. No, absolutey. One percent of users can have a problem with scripts. If we block them, then people stop buying our AV.

I think you greatly underestimate the prevalence of scripts in a home environment.

I do not think so. I could say the same about AV vendors, but in fact such a statement would be hard to prove, because the people can have very different home environments. For example, in the home environments known by me, the scripts can be restricted/blocked without any issues. There are probably many similar home environments, and probably some which will require scripts.

In fact, Windows ships quite a few scripts that are enabled by default to run for maintenance tasks.

The scripts in the home environment can be blocked with medium integrity level, and then there will be no problem with Windows maintenance tasks.

A lot of installers and updaters will run scripts automatically in the background to do things. Some developers are just outright stupid and run cmd.exe just to copy files because using the CopyFile API would be too easy.

'A lot' means probably 1% or fewer. Let's allow home users to block scripts when they install 99% of the other applications. There is a thread about OSArmor, and after reading all posts, I can say that people had problems with scripts rarely.

 

[Fabian Wosar]

I do not think so. I could say the same about AV vendors, but in fact such a statement would be hard to prove, because the people can have very different home environments. For example, in the home environments known by me, the scripts can be restricted/blocked without any issues. There are probably many similar home environments, and probably some which will require scripts.

None of them has an HP Printer? Lucky you. Their install packages are literally held together by a bunch of batch and VBS scripts.

'A lot' means probably 1% or fewer. Let's allow home users to block scripts when they install 99% of the other applications. There is a thread about OSArmor, and after reading all posts, I can say that people had problems with scripts rarely.

It's a lot less than 1% who use scripts. The problem is that it is high profile software packages that do it. VMware, Office, HP driver installers. In fact, a single installer doing it is enough to make it a blocker (no pun intended) for a general purpose product if that single installer has a large installation base.

Edit: I looked at OSArmor and I think we may be talking two different definitions of scripts here. It seems your definition of scripts is limited to Powershell and Windows Scripting Host related things (VBS, JS, WSH etc.). As those are the ones they block by default. You can probably get away with blocking those (or you know: Just uninstall the Powershell and Windows Scripting Host feature). A lot of the rules OSArmor has are already included in the behaviour blocker as well.

When you said scripts without specifying which types of scripts, I assumed you wanted to block Batch, INF and CMD scripts as well, which will cause all hell to break loose.

 

[Xtwillight]

Hello from me very appreciated Fabian Wosar !
First of all I would like to express my regret about the fact that you are threatened by
forced by malware programming you fill test from Germany to Great Britain to move.
I will put the current text here in German and English,
Because my English isn't that good.

In German

Hallo von Mir sehr geschätzter Fabian Wosar !
Erst einmal möchte ich mein Bedauern darüber aussprechen das Du durch Drohungen
von Malware Programmieren dich gezwungen fülltest von Deutschland nach Großbritannien
umzuziehen.
Den jetzigen Text werde ich in Deutsch und Englisch hier setzen,
Weil mein Englisch nicht so Gut ist.

Es gibt immer Kunden und Anwender, die es anders sehen. Wir machen diesen test ausgeführt, um zu sehen, was der Allgemeine Konsens ist.

Da ist Richtig das es immer so sein wird das man nicht mit allem was eine Firma oder ein
Produkt macht einverstanden ist.
Du hast geschrieben ihr habt Test zu den Bestellvorgang gemacht um zu sehen was der
Allgemeine Konsens ist.
Wie muss oder soll man/Frau sich das vorstellen ?
Habt ihr mit Normalen Kunden oder Geschäftskunden Bestellvorgangs Test gemacht ?

Wir sehen schon Emsisoft Anti-Malware als service. Verschieben eines Abonnements und somit eine echte software-as-a-service-Konzept ist ein sehr logischer Schritt in diesem Kontext. Ich wäre nicht überrascht, wenn wir angeboten, monatlichen Abonnements an einem Punkt, dass Sie Abbrechen können, Wann immer Sie wollen.

Fabian es ist bekannt das ihr die Emsisoft Anti-Malware mehr als Service und weniger als Software
sieht , das hat auch Christian Mairoll schon in eignen seiner Artikel geschrieben .
Es spricht nicht gegen ein Abonnement, einzig und allein das es ein Bestellvorgang ist der
initial ein Abonnement auslöst ist meine Kritik .
Ich gehe zwar nicht so weit das ich es Anpranger wie ich es damals bei Bitdefender als
das Abonnement schön versteckt im Bestellvorgang wurde und nach herber und langer Kritik
besser sichtbar gemacht wurde.
Ich finde es schade erst ein Initialisiertes Abonnement Bestellvorgang ausgelöst wird !

Und der andere Weg, um den Kunden, der möchte ein Abonnement muss mindestens einen Schritt mehr als der Kunde, der nicht. Welche dieser beiden Kundengruppen ist die richtige?

Ich sage das wird die Zeit Zeigen, ob die Kunden alle das System des Bestellvorgang mit
Initialisiertes Abonnement annehmen werden .
Thomas Ott sagte ja bereits das ihr auch sehr viele Positive Rückmeldungen für
das neue Bestell System bekommen habt.
Aber man kann auch die andere Seite im Emsisoft Support Forum lesen,
User die das nicht wollen und die auf Grund dieses neuen Bestellvorgangs Emsisoft Antimalware
nicht mehr kaufen .
Da keiner die Angaben der Positive Rückmeldungen nachlesen kann und im Support Forum
scheinbar fast sich nur die negativen Kommentare befinden.

Also wird es die Zeit und die Bestellungen zeigen ob sich euer neues Bestellsystem durchsetzt
, den es ist wie überall wo man eine Produkt oder eine Dienstleistung verkauft.
Wenn die Kunden es nicht so annehmen wie man es möchte, kann es sein das man Kunden verliert
bewährt sich ein System und man hält oder vergrößert seinen Kundenstamm dann hat man alles
richtig gemacht .

So wird das letztendlich auch eine Kunden Entscheidung sein ob das neue Initialisierte
Abonnement Bestellvorgang System so angenommen wird wie ihr euch es erhofft .

Fabian ich mag euer Firmen Philosophie, eure Standpunkte zu Datenschutz und was ein
Antivirus darf und was es nicht machen sollte.
Nur mit dem neuen ABO System bin ich nicht eurer Meinung .


mit besten und freundlichen Grüßen

In English

There are always customers and users who see things differently. We run this test to see what the general consensus is.

It's true that it will always be that way that you won't have to deal with everything that a company or an
product makes is in agreement.
You have written you have made test to the ordering process to see what the
General consensus is.
How must or should one imagine this ?
Have you tested the ordering process with normal customers or business customers ?

We already see Emsisoft Anti-Malware as a service. Moving a subscription and thus a real software-as-a-service concept is a very logical step in this context. I wouldn't be surprised if we offered monthly subscriptions at a point that you can cancel whenever you want.

Fabian it is known to you that the Emsisoft Anti-Malware is more a service than software.
Christian Mairoll has already written this in his own articles.
It does not speak against a subscription, only that it is an order process the
Initially triggering a subscription is my criticism.
I don't go as far as I want it to be a pillory as I did at Bitdefender back then as a
the subscription was beautifully hidden in the ordering process and after bitter and long criticism
has been made more visible.
I think it's a pity that an initialized subscription order process is triggered first !

And the other way to reach the customer who wants a subscription must be at least one step more than the customer who does not. Which of these two customer groups is the right one?

I say this will show the time, whether the customers all use the system of ordering process with
Accept Initialized Subscription .
Thomas Ott already said that you also very many positive feedback for
the new ordering system.
But you can also read the other side in the Emsisoft Support Forum,
Users who don't want this and who are using Emsisoft Antimalware due to this new order process
no longer buy .
Since no one can read the positive feedback and in the Support Forum
seem to be almost entirely negative comments.

So the time and the orders will show if your new order system will prevail.
Show that it is like anywhere you sell a product or service.
If the customers don't accept it the way you want, it can be that you lose customers.
a system proves its worth and you keep or enlarge your customer base then you have it all
done right.

So in the end this will also be a customer decision whether the new initialized
Subscription ordering system is accepted as you expect it to be.

Fabian I like your company philosophy, your points of view about privacy and what a
antivirus and what it shouldn't do.
Only with the new ABO system I don't agree with you.


with best and friendly greetings

with best and friendly greetings

 

[Fabian Wosar]

Since it is easier for you to communicate in German, but I don't want to post a bunch of German replies that most people won't be able to understand, I am going to reply to you via PM.