Battle On-Demand scanners: Pro's and Con's of each

[jackuars]

I would like to compare the pro's and con's of each of these software's. I know that using more than one is ideal, but for comparison sake I would like to know what these products are good and bad at. Thanks.

Emsisoft Emergency Kit (EEK)
Malwarebytes Anti-Malware (MBAM)
Zemana Anti-malware (ZAM)
Norton Power Eraser (NPE)

 

[bjm_]

NPE does not detect malware (that is what Norton Security is for). NPE presents you with a list of files that could be malware. It is meant to be run when your Norton program does not detect anything malicious but you still suspect that something may be acting suspiciously on your PC. If there doesn't appear to be anything wrong, the results returned by NPE will almost always be safe files that belong to applications on your system. NPE doesn't tell you much about a file because it really doesn't know much about the files it presents - that's the whole point, if Norton knew whether the file was actually malicious or not you would not have to run NPE, as Norton Security would catch it if it was malicious and NPE would not flag it if it was a known good file.

 

[Evjl's Rain]

1/ Emsisoft emergency kit:
Pros:
- Extremely good at: old malwares (thanks to BitDefender's database), PUPs/adwares, malicious registry keys
- Fast scanning speed
Cons:
- Poor at: new malwares, fileless malwares
- Very large updates -> takes time and bandwidth
- No cloud implementation - There is but completely ineffective (cloud only works when executing files, not scanning)

2/ Malwarebytes free (scanner only):
Pros:
- Very good at: PUPs/adwares, new ransomware types (one of the first to have signatures when MB's engine on VT hasn't updated yet), registry keys, very good heuristics
- Quite fast scanning speed
Cons:
- Poor: regular malwares/viruses, zero-day malwares
- Has to be installed, no portable version
- No cloud engine

3/ Zemana:
Pros:
- Good at: PUPs/adwares (quite), the best scanner against fileless malwares and active processes, good signatures but not the best
- Doesn't require updates
- Fast scanning speed
- Portable version is available
- Automatic version update within app
Cons:
- Not good: zero-day malwares, doesn't always detect all old malwares
- Portable version still leave traces behind
- Version 3 removes drag-and-drop Custom scan. Version 2 still has it -> my favorite
- Prone to False postitives
- Requires 2 separate scans: 1 full + 1 custom scan of "Users" folder for full effect

4/ Norton power eraser:
Pros:
- Doesn't require signatures, functions based on file reputation analysis -> can detect new malwares/safe files if they don't have sufficient number of users
- Can detect registry keys
- Very fast scanning speed
- Portable
Cons:
- Requires manual update
- Requires 2 separate scans, same as zemana
- Extremely prone to FPs, must be used by knowledgeable users
- Doesn't always indicate which is safe, which is malicious because it's reputation-based
- Okay against fileless malwares, not as good as Zemana

5/ Hitman pro:
Pros:
- 4 Engines: Kaspersky, BD, Sophos, HitmanPro's forensic -> best for detecting old malwares, very good against new malwares and quite good against PUP/adwares
- Has Early Score Warning - kind of reputation-based rating -> prone to FPs but higher chance of detecting unknown stuffs (enable in settings)
- Scanning speed can be very fast or very slow, depends on internet connection or location (mine is very slow)
- Doesn't require 2 scans as zemana and NPE
- Fully cloud, doesn't require update
- Automatic version update within app
- Portable
Cons:
- It's a paid program, free removal of malwares within the first 15 days
- Useless against fileless malwares, almost, the worst besides EEK

 

[jackuars]

1/ Emsisoft emergency kit:
Pros:
- Extremely good at: old malwares (thanks to BitDefender's database), PUPs/adwares, malicious registry keys
- Fast scanning speed
Cons:
- Poor at: new malwares, fileless malwares
- Very large updates -> takes time and bandwidth
- No cloud implementation - There is but completely ineffective (cloud only works when executing files, not scanning)

2/ Malwarebytes free (scanner only):
Pros:
- Very good at: PUPs/adwares, new ransomware types (one of the first to have signatures when MB's engine on VT hasn't updated yet), registry keys, very good heuristics
- Quite fast scanning speed
Cons:
- Poor: regular malwares/viruses, zero-day malwares
- Has to be installed, no portable version
- No cloud engine

3/ Zemana:
Pros:
- Good at: PUPs/adwares (quite), the best scanner against fileless malwares and active processes, good signatures but not the best
- Doesn't require updates
- Fast scanning speed
- Portable version is available
Cons:
- Not good: zero-day malwares, doesn't always detect all old malwares
- Portable version still leave traces behind
- Version 3 removes drag-and-drop Custom scan. Version 2 still has it -> my favorite
- Prone to False postitives
- Requires 2 separate scans: 1 full + 1 custom scan of "Users" folder for full effect

4/ Norton power eraser:
Pros:
- Doesn't require signatures, functions based on file reputation analysis -> can detect new malwares/safe files if they don't have sufficient number of users
- Can detect registry keys
- Very fast scanning speed
- Portable
Cons:
- Requires manual update
- Requires 2 separate scans, same as zemana
- Extremely prone to FPs, must be used by knowledgeable users
- Doesn't always indicate which is safe, which is malicious because it's reputation-based
- Okay against fileless malwares, not as good as Zemana

5/ Hitman pro: I will tell my experience if you ask

Thanks I would like to know about Hitman Pro too, but mainly interested only in Free version.

For ZAM I couldn't find Portable version for v3.0. I was expecting more Pro's from EEK as it seems to be the best choice?

Also I couldnt find any custom scan option in Zemana v3.0, neither a full scan or even drag n drop support of files. Have they removed these features?

 

[Evjl's Rain]

Thanks I would like to know about Hitman Pro too, but mainly interested only in Free version.

For ZAM I couldn't find Portable version for v3.0. Also I was expecting more Pro's from EEK as it seems to be the best choice?

Also I couldnt find any custom scan option in Zemana v3.0, neither a full scan or even drag n drop support of files. Have they removed these features?

here is version 2, which still has the custom scan

http://dl12.zemana.com/AntiMalware/2.74.2.664/Zemana.AntiMalware.Portable.exe?__c=1

version 3 only has full scan, which ignores Users folder, if I'm not mistaken

I don't like EEK much because it's heavy and requires updates
the signatures are very very good but not good against fileless malwares, almost useless, same as hitmanpro
my combo is NPE+zemana v2 because they cover everything
I only use EEK in safe mode on heavily infected PC or on a there is no internet

 

[blackice]

No ESET Online Scanner? That’s an odd duck in the bunch.

 

[jackuars]

No ESET Online Scanner? That’s an odd duck in the bunch.

Good choice, but I mainly use only desktop software's

 

[Evjl's Rain]

No ESET Online Scanner? That’s an odd duck in the bunch.

ESET online scanner has one of the best signatures and probably the best against adwares and PUPs, option for PUAs such as ccleaner. It's really aggressive
however, it takes ages for updating for the first time (must) and takes almost forever to fully scan the PC on HDD, much better on SSD

highly recommend to scan the PC every 6 months with ESET because it's very time-consuming

 

[TairikuOkami]

From the OP, I guess you are asking about on-demand scanners to be used for your computers?
Since Evjl's Rain has already provided a very detailed review, the choice is obvious (EEK+NPE).

But if you are also interested in scanning other computers, that changes things a little. MBAM+ZAM are out of the question, because they have to be installed, that is always complicated on an infected computer. EEK requires a painfully slow and big update. NPE requires an internet, which can be blocked (via HOSTS). FRST, then CureIt and KVRT would be my first choices, they are always updated. Not to mention a must check via Autoruns.

 

[thrillskr]

Zemana 2 and Hitman Pro and Roguekiller with MALPE engine.

 

[jackuars]

1/ Emsisoft emergency kit:
Pros:
- Extremely good at: old malwares (thanks to BitDefender's database), PUPs/adwares, malicious registry keys
- Fast scanning speed
Cons:
- Poor at: new malwares, fileless malwares
- Very large updates -> takes time and bandwidth
- No cloud implementation - There is but completely ineffective (cloud only works when executing files, not scanning)

2/ Malwarebytes free (scanner only):
Pros:
- Very good at: PUPs/adwares, new ransomware types (one of the first to have signatures when MB's engine on VT hasn't updated yet), registry keys, very good heuristics
- Quite fast scanning speed
Cons:
- Poor: regular malwares/viruses, zero-day malwares
- Has to be installed, no portable version
- No cloud engine

3/ Zemana:
Pros:
- Good at: PUPs/adwares (quite), the best scanner against fileless malwares and active processes, good signatures but not the best
- Doesn't require updates
- Fast scanning speed
- Portable version is available
- Automatic version update within app
Cons:
- Not good: zero-day malwares, doesn't always detect all old malwares
- Portable version still leave traces behind
- Version 3 removes drag-and-drop Custom scan. Version 2 still has it -> my favorite
- Prone to False postitives
- Requires 2 separate scans: 1 full + 1 custom scan of "Users" folder for full effect

4/ Norton power eraser:
Pros:
- Doesn't require signatures, functions based on file reputation analysis -> can detect new malwares/safe files if they don't have sufficient number of users
- Can detect registry keys
- Very fast scanning speed
- Portable
Cons:
- Requires manual update
- Requires 2 separate scans, same as zemana
- Extremely prone to FPs, must be used by knowledgeable users
- Doesn't always indicate which is safe, which is malicious because it's reputation-based
- Okay against fileless malwares, not as good as Zemana

5/ Hitman pro:
Pros:
- 4 Engines: Kaspersky, BD, Sophos, HitmanPro's forensic -> best for detecting old malwares, very good against new malwares and quite good against PUP/adwares
- Has Early Score Warning - kind of reputation-based rating -> prone to FPs but higher chance of detecting unknown stuffs (enable in settings)
- Scanning speed can be very fast or very slow, depends on internet connection or location (mine is very slow)
- Doesn't require 2 scans as zemana and NPE
- Fully cloud, doesn't require update
- Automatic version update within app
- Portable
Cons:
- It's a paid program, free removal of malwares within the first 15 days
- Useless against fileless malwares, almost, the worst besides EEK

Hi Evjl,

What about Dr.Web CureIt!? What are it's good and bad?

 

[Evjl's Rain]

Hi Evjl,

What about Dr.Web CureIt!? What are it's good and bad?

I don't really know what to say about it
it does have some pros:
- good signatures (not the best)
- very good disinfection

Big cons:
- has to download a new scanner as an update (~180MB+)
- File name of the scanner looks very malicious with random characters: last time I downloaded qvn431y3.exe
- very slow scanning speed, even on SSD
- Force users to accept DrWeb's data collection in free version (if not, can't download and scan)
- No cloud integration
- Consumes all CPU during scan
- No option to improve detection rate
- Questionable against fileless malwares (I haven't tried it yet since the scanning speed is too slow, no time for testing)

I think it should not be used as a regular scanner. I prefer cloud scanners because they are always up-to-date and usually have very fast scanning speed
offline scanners, ESET and EEK are the best. EEK is much faster than ESET
forget about kaspersky's scanner. It's really bad, slow and has ancient engine compared to kaspersky antivirus versions

 

[TairikuOkami]

- File name of the scanner looks very malicious with random characters: last time I downloaded qvn431y3.exe

That is done on purpose, since some malware blocks executables based on the known names. So it is something I actually really like about it.

 

[cosmos]

FRST, then CureIt and KVRT would be my first choices, they are always updated. Not to mention a must check via Autoruns.

Apologies, missed this!

FRST: I think you must have some technical insight on how to use it, correct?

In general, why aren't you recommending the same tools (ie Zemana, NPE, EEK etc) for infected systems?

If so, what are the Cureit merits?

 

[TairikuOkami]

FRST: I think you must have some technical insight on how to use it, correct?

Yes, but I do not expect common users to clean malware anyway, they search for "the best scanner" and use the rubbish (Spybot, TotalAV, etc).

In general, why aren't you recommending the same tools (ie Zemana, NPE, EEK etc) for infected systems?

Because they are not ready to go, they have to be updated first or connected to the internet and that can be problem sometimes.
That is, why I recommended to Windows Repair Toolbox's author to use Tor for troubleshooting, it creates its own internet connection.
The best option is to use bootable ISO, but that is for heavily infected systems and in that case it is probably better to just reinstall ASAP.

25+ Bootable Rescue Disks of All Major Antivirus: Free Download Links

Free Download Bootable Rescue Disk of Avast, Kaspersky, Bitdefender, Nortan, AVG, Windows Defender, ESET, etc. Antivirus to Boot in Unbootable System & Clean Virus

sguru.org

If so, what are the Cureit merits?

Download on USB - run - scan - that is it, it is fully portable, unless it is blocked by malware based on the signature, like smartservice did, but that is rare. The disadvantage is, that you have to download the latest version before the scan, so the tool depends on the circumstances, but I prefer portable.

 

[cosmos]

Awesome explanation, thanks!

 

[Ink]

Cons:

• Waste of time

If you need to use any on-demand scanning tools then your first level of defences have failed.