Malware Hub Report PcMag Emsisoft Anti-Malware 2017

[Solarquest]

• Pros
  Excellent scores in our malware blocking and malicious URL blocking tests. Good scores in lab tests. Effective behavior-based detection can even spot ransomware. Clean, simple user interface.
  
  
• Cons
  So-so score in our antiphishing test. Behavior-based detection warns about both valid programs and malware.
  
  
• Bottom Line
  Hence the name, Emsisoft Anti-Malware focuses on the core task of keeping your PCs free of malware. It does a good job, and with a clean, simple interface, it looks good too.

more in the link above.

 

[Huchim]

First time that I see a decent review of Emsisoft. Always "lacking in phishing protection" but I think that is not their main priority. Use avira or avast extension on your favorite browser and let Emsisoft make the job against malware.

 

[Winter Soldier]

This time I agree enough with this review but I really disagree with the judgement about web security: when I was using EAM I had set "HostAD/tracking" on Block and Notify.
Always got a lot of alerts during the navigation on unknown pages.

 

[Windows Defender Shill]

So maybe Emsisoft doesn't receive Bitdefender phishing URLs?

Because to my knowledge Bitdefender has maybe the best phishing protection.

 

[spaceoctopus]

''Behavior-based detection warns about both valid programs and malware''
It's exactly what it should be doing. If not, behavioral protection makes no sense.

It's true that Emsisoft is a bit weak on anti-phishing and web protection,but it's not that bad. I'm sure they will improve in that area.

 

[Winter Soldier]

So maybe Emsisoft doesn't receive Bitdefender phishing URLs?

Because to my knowledge Bitdefender has maybe the best phishing protection.

In my opinion, Emsisoft receives BD malware signatures, but not the Phishing Urls.

 

[Sunshine-boy]

So maybe Emsisoft doesn't receive Bitdefender phishing URLs?

Because to my knowledge Bitdefender has maybe the best phishing protection.

u can add Bitdefender TrafficLight extension and cover that weakness

 

[Malware Person]

nice review of Emsisoft! Certainly better than the review PCMag gave last time

 

[Malware Person]

i think Emsisoft also uses BitDefender signatures, so that's why its detection rate is pretty good

 

[ZeroDay]

i think Emsisoft also uses BitDefender signatures, so that's why its detection rate is pretty good

BD signatures aren't that good anymore.

 

[Game Of Thrones]

BD signatures aren't that good anymore.

agree, I'm using f secure and for new malware, it uses deep guard and cloud detection. bd signature today is not good because BitDefender is now going for behavior and cloud detection if you use their 2018 beta you see that they are going all in BB and cloud

 

[Nightwalker]

Signatures aren't that good anymore.

 

[ForgottenSeer 58943]

BD signatures aren't that good anymore.

BD sigs are still way up there. Shadowserver scans on the honeypot show us they're still very good in the signature department. Products with mostly reputation/karma, cloud, machine learning tech are at the bottom. Hybrid products around the middle. If BD is indeed moving to a less of a signature system then I would expect Shadowserver results next year will show it.

Also, Emsisoft is becoming annoying by flagging so many false positives.. Almost a dozen a week I have to whitelist on systems in my home. Now it's taken affinity to quarantining many of my Steam games. I'm thinking of adding Forticlient (Paid - due to free licenses on my Fortigate Appliance). That, combined with Default-Deny VoodooShield and Heimdal should be sufficient.

 

[ZeroDay]

BD sigs are still way up there. Shadowserver scans on the honeypot show us they're still very good in the signature department. Products with mostly reputation/karma, cloud, machine learning tech are at the bottom. Hybrid products around the middle. If BD is indeed moving to a less of a signature system then I would expect Shadowserver results next year will show it.

Also, Emsisoft is becoming annoying by flagging so many false positives.. Almost a dozen a week I have to whitelist on systems in my home. Now it's taken affinity to quarantining many of my Steam games. I'm thinking of adding Forticlient (Paid - due to free licenses on my Fortigate Appliance). That, combined with Default-Deny VoodooShield and Heimdal should be sufficient.

I'm interested in trying out Forticlient too they seem to have excellent signatures which is what I'd want it for, Comodo firewall is my main third party protection and I think Forticlient free would complement it nicely. I'm using BD free at the moment alongside CF mainly because as far an standard AV's go I want one that sits in the background doing it's job whilst I can tweak CF until my heart's content. There's a very good chance I'll end up back using KIS though.

 

[_CyberGhosT_]

While I don't read PCmag for it's reviews, I agree that this one is more focused and spot on than past reviews of EmsiSoft.
@Game Of Thrones
I would love to see a "All Cloud" BitDefender with a bad azz BB down the road, I would use that for sure.

 

[Arequire]

I'm interested in trying out Forticlient too they seem to have excellent signatures which is what I'd want it for, Comodo firewall is my main third party protection and I think Forticlient free would complement it nicely. I'm using BD free at the moment alongside CF mainly because as far an standard AV's go I want one that sits in the background doing it's job whilst I can tweak CF until my heart's content. There's a very good chance I'll end up back using KIS though.

A couple of things about Forticlient:

1. Its installer is awful. It takes aeons to download, scan and then finally install.
2. Forticlient's free version is purely signature based. That won't be a problem if you're planning on running it alongside CF though.
3. It has absolutely outstanding malicious URL blocking.

 

[ZeroDay]

A couple of things about Forticlient:

1. Its installer is awful. It takes aeons to download, scan and then finally install.
2. Forticlient's free version is purely signature based. That won't be a problem if you're planning on running it alongside CF though.
3. It has absolutely outstanding malicious URL blocking.

Looks like I'm going to install it and see how it runs for a couple of weeks. I think it would be a great complement to CF with the signatures and web guard. And thank you for the info.

 

[ForgottenSeer 58943]

A couple of things about Forticlient:

1. Its installer is awful. It takes aeons to download, scan and then finally install.
2. Forticlient's free version is purely signature based. That won't be a problem if you're planning on running it alongside CF though.
3. It has absolutely outstanding malicious URL blocking.

1) The installer is fine, but it does download modules and updates during the installation. You can cancel the pre-install scan by clicking cancel. In all fairness, the installation is much quicker for me since I have a Fortigate on my gateway it installs with pushes from the appliance vs over the internet.
2) Version 5.6 has introduced a lot of new technologies under the hood that aren't self evidence. It's progressed from a pure signature based scanner. Although the signatures are pretty well regarded in the industry. Fortinet is very speedy with updating them - try the submission and see. (while Trend is glacially slow)
5.6 introduced Rootkit Detection, Vulnerability Scanning, Threat Intelligence and Anti-Botnet/Ransomware technology.

3) Indeed. Fortinet has perhaps the best malicious URL blocking in the industry, among any product.

A few tidbits for the technically inclined. If you install Forticlient you can go to settings, then hit 'backup' to backup the configuration. This is an XML-Style file that allows you to seriously dig into the product and tweak a lot of things under the hood that aren't available in the GUI. So make the backup, make a copy of the backup (just in case you mess up the script), then dig into the script for the juicy bits. (use Notepad++ or something)

The GUI is purposely limited so people don't click things in an enterprise environment and get unexpected results. You can do fun stuff like turn on multi-core scanning/processing which makes it ridiculously fast. You can dial up heuristics, turn on extreme databases for even greater signatures, etc.. Here's a small snippet;

<antivirus>
<enabled>1</enabled>
<signature_expired_notification>0</signature_expired_notification>
<scan_on_insertion>0</scan_on_insertion>
<shell_integration>1</shell_integration>
<antirootkit>4294967295</antirootkit>
<fortiguard_analytics>1</fortiguard_analytics>
<multi_process_limit>1</multi_process_limit>
<scheduled_scans>
<ignore_3rd_party_av_conflicts>0</ignore_3rd_party_av_conflicts>
<!--zero, one or more of the following child nodes-->
<full>
<enabled>1</enabled>
<repeat>2</repeat>
<day_of_month>1</day_of_month>
<time>19:30</time>
<removable_media>1</removable_media>
<network_drives>0</network_drives>
<priority>0</priority>
</full>
</scheduled_scans>
<on_demand_scanning>
<use_extreme_db>1</use_extreme_db>
<on_virus_found>4</on_virus_found>
<pause_on_battery_power>1</pause_on_battery_power>
<signature_load_memory_threshold>8</signature_load_memory_threshold>
<automatic_virus_submission>
<enabled>0</enabled>
<smtp_server>fortinetvirussubmit.com</smtp_server>
<username>Enc 341b4a044abc73d0d7cc417825d302784a359e5d30ef9432</username>
<password>Enc 16e87c0533f9a541b9895fa24f7d881da4da55430d653464</password>
</automatic_virus_submission>
<compressed_files>
<scan>1</scan>
<maxsize>0</maxsize>
</compressed_files>
<riskware>
<enabled>1</enabled>
</riskware>
<adware>
<enabled>1</enabled>
</adware>
<heuristic_scanning>
<level>3</level>
<action>2</action>
</heuristic_scanning>

Disclaimer: I'm a Fortigate NSE5 engineer. I will be happy to help anyone with questions about any setting or how the various technologies work. In my personal opinion, Forticlient makes a fantastic solution to combine with another one. For me, that's Voodooshield and Forticlient. I assume it would rock out with Comodo.

One thing to add - Forticlient adds a context menu for virus submission. This goes directly into the lab. Expect fast responses.

 

[Arequire]

Version 5.6 has introduced a lot of new technologies under the hood that aren't self evidence. It's progressed from a pure signature based scanner.

That's good to hear. Wasn't aware that it updated. I tried it out sometime early last year and it was purely signatures back then.

 

[ForgottenSeer 58943]

A couple important settings are in the XML dump.

Turn on sandbox signatures (APT). Also turn on the virus database to 'extreme'; (0 is off, 1 is on)

<real_time_protection>
<enabled>1</enabled>
<use_extreme_db>0</use_extreme_db>
<when>0</when>
<ignore_system_when>2</ignore_system_when>
<on_virus_found>5</on_virus_found>
<popup_alerts>1</popup_alerts>
<popup_registry_alerts>0</popup_registry_alerts>
<bypass_java>0</bypass_java>
<cloud_based_detection>
<on_virus_found>4</on_virus_found>
</cloud_based_detection>
<sandboxing>
<use_sandbox_signatures>1</use_sandbox_signatures>
</sandboxing>

Extreme turns on ALL of the signatures which effectively triples the size of the signature database and it isn't so reliant on zero-days or recent events but expands it to capture some stuff that's been around for awhile. It also expands it to encompass other operating systems, such as Windows XP threats. Fortinet explains that better here;

Extreme The extreme antivirus database allows scanning for both “in the wild” and “zoo” viruses that are no longer seen in recent studies as well as all available signatures that are currently supported. The extreme database provides flexibility, providing the maximum protection without sacrificing performance and is suited to an enhanced security environment.

Edit: Maybe Mods could consider a Fortinet/Forticlient Sub-Forum?