[Review] Emsisoft Anti-Malware 7 (paid version)

  • Thread starter Deleted member 178
  • Start date
Status
Not open for further replies.
D

Deleted member 178

Thread author
Emsisoft Anti-Malware

Homepage

Emsisoft Anti-malware (Aka EAM) is one of the best Antivirus available on the market, it has 2 versions:

1- The free version: used just as an "on-demand" scanner, you will have access only to the antivirus engines and updates.

2- The Paid version: the full version with Behavior Blocker and Surf protection, i will describe it now.

Here the top results of EAM for 2012 in the MRG Flash Tests

Lets go now for a tour !

0- Security Status

A2ZjZ.jpg

The Emsisoft Anti-Malware start screen, called "Security Status", shows an overview of all program and configuration options; here you have access to all functions of EAM and to some informations concerning its current version and signature database plus some links to Emsisoft.

The security status window is divided into three sections.

Code:
The first part is the menu on the left, containing "Scan PC", "Quarantine", "Logs", "Guard" and "Configuration", and it provides easy access to all relevant program options and configuration dialogs. 

The middle area provides a status overview of the major program components such as the Guard, Scanner and Update settings. Each component of Emsisoft Anti-Malware has a separate entry and can be directly toggled on or off using the mouse. "Settings" takes you to the corresponding configuration dialog for the respective component. "Emsisoft News" shows the latest Emsisoft headlines and keeps you up to date on the latest news. 

The third and last area on the right provides you with access to the main Emsisoft Anti-Malware resources, including the Emsisoft homepage, contact details for Emsisoft, Support forum, Security articles and also allows you to send suspicious files to our experts for analysis. The lower part of this area shows the exact version number of Emsisoft Anti-Malware, the number of signatures used for scanning and the number of days remaining before your license expires

1- File Guard

Like some other Antiviruses (Gdata, Coranti, roboscan, etc…) EAM engine is composed of 2 engines, Emsisoft engine and Bit Defender engine, the association of both makes EAM a potent AV with a high detection rate, EAM is one of the few AV that almost passed all detection test in various virus test labs (MRG for example), but because of that EAM may be a bit heavy on resources for some computers, especially during an update of his database or a scan (~180mb)

a- Application rules

lJZ9J.jpg

The place where you set the rules for the various softwares runnings on your system.

Code:
"Application Rules" lists all application rules that have been defined, with filename and mode. The filename field shows the file path of the program for which the rule was created. The mode field shows whether the program is blocked (Blocked), excluded from monitoring (Excluded) or monitored (Monitored). "Monitored" means that particular behavior is allowed but the program will still be monitored by Emsisoft Anti-Malware for other suspicious behavior. 

Rules can be added, edited and deleted.

b- File Guard

UVekd.jpg

Here the settings for the real-time module.
An interesting feature is that EAM allow you to choose between performance or protection, you have 3 choices (scan before executed, scan additionally when created + modified, and scan additionally when read)
Setting EAM on "scan only program before they are executed" is the setting that reduces the resources usage the most while offreing a decent protection.

Code:
Scan only programs before they are executed - This setting configures executable files to be scanned immediately before they run. This setting has the least effect on the performance of your system while still providing sufficient protection.
 
Additionally scan all files when they are created or modified - This setting configures all files to be scanned when they are created or written to. For example, this occurs when a file is downloaded or copied onto your computer from a USB stick. 

Additionally scan all files when they are read - This setting causes all files to be scanned before every read operation, so that simply selecting a file is sufficient to cause it to be scanned. This setting has the greatest effect on your system performance and should only be used on high end systems. 

The File Guard not only scans files before they are executed, but depending on the chosen settings, also before all other file actions such as moving or downloading from the Internet.

- Detect Riskware - When this check box is selected the File Guard also raises an alert for so-called Riskware. Riskware is usually defined as benign software that can be used for malicious purposes by Malware authors. In the case of a Riskware alert you should always check whether you installed the program intentionally or not.

what is a Riskware

c- Scan

EAM possess various kind of scans

gftzB.jpg

- Quick Scan - Scans all active programs and Spyware Traces.
- Smart Scan - Good, fast result, but only important folders will be scanned.
- Deep Scan - Slowest scan, all files on all hard disks will be scanned deeply.
- Custom Scan - All scanner settings can be manually set and stored for later use.

EAM scans performances can be adjusted to your needs

vxok8.jpg

Code:
Use the following processors for scans -Advanced users may wish to limit scans to using only a certain number of processors if they require individual processors to be reserved for other tasks. By default all processors are used. 

Number of threads - Specifies the number of worker threads active during a scan. The default is the number of processors being used for scanning plus one for reading the data. 

Scan thread priority - Advises Windows to give the scanning threads the specified priority over other running processes. Priority can be set to a minimum to avoid negatively affecting the performance of other active tasks, e.g. when running lengthy background scans. 

Use advanced data caching - Allows intelligent self-optimization of scans on a continual basis by avoiding the need to re-examine known safe files if their contents remained unchanged.


2- Behavior Blocker

EAM incorporates, what i consider, the best Behavior Blocker in the market named Mamutu (also made by Emsisoft); my comrade Biozfear made a very good review of it here

a- Behavior Blocker

GuG0W.jpg

Code:
The "Behavior Blocker" tab allows you to define the types of behavior that should be monitored system-wide by Emsisoft Anti-Malware.

b- Alert Setting

OZUt1.jpg

Here you have various options concerning the Behavior Blocker "Behavior" :p (ok easy joke), it is also here that you can see the "Cloud" feature of EAM.

Code:
Emsisoft Anti-Malware reports the behavior of programs that are sometimes clearly dangerous but sometimes also only possibly dangerous. With some benign programs a clear decision between benign and malicious behavior is not technically possible. Emsisoft Anti-Malware always reports this type of suspicious behavior unless you activate alert reduction to reduce the number of false alerts relating to benign programs.

The most important are:

- Activate intelligent alert reduction - Emsisoft Anti-Malware performs a technical analysis of the program file of a suspicious program to identify whether it is benign or not. Good examples of false alerts are Explorer.exe (Windows Explorer), Internet Explorer or Firefox. When starting, all these programs exhibit behavior that is also used by Malware. For example, changing the browser settings or generating network traffic without a visible user interface. If intelligent alert reduction is not activated, then warning alerts are generated each time these programs start. With intelligent alert reduction activated, Emsisoft Anti-Malware recognizes that these are legitimate programs and doesn't generate warning alerts. The intelligent alert reduction is deactivated by default because in rare situations it is possible that it could allow a dangerous program to become active.

- Community-based alert reduction - Emsisoft Anti-Malware relies on the intelligence of the masses. When this option is activated, an online query is sent to the Anti-Malware Network and the decisions of all Emsisoft Anti-Malware users on what to do with a reported program (allow, block, quarantine, exclude from monitoring) are displayed as a colored graphic. Emsisoft Anti-Malware uses this to provide a recommendation of how to proceed with the reported program.

- Activate paranoid mode - Alerts for additional possibly malicious activity by applications with a suspicious or Malware-like file layout. This option is deactivated by default because it can produce many false alerts and is only recommended for advanced users

Here an interesting article concerning EAM Behavior Blocker

3- Surf Protection

a- Surf Protection

JBzkK.jpg

His component protects you from dangerous website and links, an unaware user will be unable to access some kind of dangerous websites (depending of the settings).

b- Host Rules

eela6.jpg

EAM possess this HOST rules component containing Black Listed domains. You can manually add your own list to increase its efficiency, i personally add the MVPS Host List.

Code:
The "Host Rules" module lists all rules created for blocked and allowed hosts with "Hostname" and "Mode". The rules can be individually added, edited or removed.

4- Configuration

Here the various options available, the most noticeable are:

- Activate email scanning - Allows email scanning to be integrated into Microsoft Outlook 2003, 2007, and 2010. For advanced email scanning settings, please open your email client and open the Anti-Malware settings in the newly appeared toolbar/ribbon.

- Activate memory usage optimization - When enabled this option reduces the amount of RAM being used by swapping out non-active data (such as signatures) to the pagefile. On older PC's this may result in system slowdowns. If you have sufficient RAM, you may wish to disable this feature to ensure maximum speed.

5- Hijack Free

It is a process/services/autoruns/ports monitor that allow an user to check what happening in his system and terminate or delete illegitimate processes and files.

Nvqpc.png

Final Note :

Not to say, EAM is my favorite antivirus, i use it since very long time, and it never failed me yet, its user-friendliness and great protection made it a masterpiece in my security configuration. I rate it 5/5 .

EAM is also part of Emsisoft Internet Security Pack (Emsisoft Anti-Malware + Online Armor Premium)
 

villandra

New Member
Feb 27, 2013
1
Your review has not been my experience.

While using it, I had no indication that this product stopped viruses from downloading onto my computer. The web site does not explicitly say that this product prevents known malware from downloading. If the software doesn't stop known beasties from downloading onto my computer, I've absolutely no interest in what it does next. Emsisoft admits, uncharacterstically accurately, that once malware is on your machine more often than not it can't be removed. Several online reviews, see below, give Emsisoft a low rating for ability to remove viruses it finds on your computer, relative to other software.

Avast on the other hand blocks known malware from downloading. It's stopped alot of malware from downloading onto my machine and missed one that nothing could identify.

The Emsisoft web site, which is filled with hype, never actually explicitly lists specifically what this product does and does not do.

I caught the program using a full 500,000 M of RAM. That is way too much, and would hang any computer more than a couple of years old.

The company uses scare tactics. For instance, a prominently displayed article on the web site claims that ransomware will infect even your backup drives, and there won't be anything you can do. Other IT experts are saying that while Ransomware exists adn can do that it is rare and not much of a threat. It's also unclear how Emsisoft would prevent ransomware since it doesn't stop malware from downloading. The theme of Emisoft's current newsletter is their claim that NBC's web sites are infected with malware.

Emsisoft Antimalware costs twice as much as most other antivirus software, and you have to buy a second product for sandboxing, which Avast's standard price product includes.

As far as a debate here about possible favoritism, anytime a web site gives software an unqualified review, and particularly if it's terrible software, I really have to wonder.

http://www.pcmag.com/article2/0,2817,2364196,00.asp

http://fileforum.betanews.com/detail/Emsisoft-AntiMalware/1151054587/1
 

Exterminator

Community Manager
Verified
Staff Member
Well-known
Oct 23, 2012
12,527
Thanks again Umbra for a very comprehensive and unbiased review.
 
I

illumination

Thread author
villandra said:
Your review has not been my experience.

While using it, I had no indication that this product stopped viruses from downloading onto my computer. The web site does not explicitly say that this product prevents known malware from downloading. If the software doesn't stop known beasties from downloading onto my computer, I've absolutely no interest in what it does next. Emsisoft admits, uncharacterstically accurately, that once malware is on your machine more often than not it can't be removed. Several online reviews, see below, give Emsisoft a low rating for ability to remove viruses it finds on your computer, relative to other software.

Avast on the other hand blocks known malware from downloading. It's stopped alot of malware from downloading onto my machine and missed one that nothing could identify.

The Emsisoft web site, which is filled with hype, never actually explicitly lists specifically what this product does and does not do.

I caught the program using a full 500,000 M of RAM. That is way too much, and would hang any computer more than a couple of years old.

The company uses scare tactics. For instance, a prominently displayed article on the web site claims that ransomware will infect even your backup drives, and there won't be anything you can do. Other IT experts are saying that while Ransomware exists adn can do that it is rare and not much of a threat. It's also unclear how Emsisoft would prevent ransomware since it doesn't stop malware from downloading. The theme of Emisoft's current newsletter is their claim that NBC's web sites are infected with malware.

Emsisoft Antimalware costs twice as much as most other antivirus software, and you have to buy a second product for sandboxing, which Avast's standard price product includes.

As far as a debate here about possible favoritism, anytime a web site gives software an unqualified review, and particularly if it's terrible software, I really have to wonder.

http://www.pcmag.com/article2/0,2817,2364196,00.asp

http://fileforum.betanews.com/detail/Emsisoft-AntiMalware/1151054587/1

This is a review of a product, it was not a product vs product thread. But since you insisted, and used PC Mag as an example, one can also look up their latest review on Avast, and it did not fair so well either, matter of fact Comodo and Webroot aced "100%" in detection where Avast did not in a standard malware blocking test, where Avast only detected 89%.
Avast IS on PC MAG

Now you will argue this is not the latest release of Avast, well, that was not the latest release of EAM either.. Fair enough?

@Umbra, nice review as always!
 

Littlebits

Retired Staff
May 3, 2011
3,893
Emsisoft Anti-Malware 7 is an excellent product outside of all of the false positives.

Good review, however I would have gave it 4 stars because of the false positives. The only thing worse than a product with low detection rate is a product with high false positives. False positives can cause more problems then many infections can.

Thanks.:D
 
D

Deleted member 178

Thread author
villandra said:
Your review has not been my experience.

Every system is different, so of course my review is not the perfect reflection of every users experiences.

While using it, I had no indication that this product stopped viruses from downloading onto my computer. The web site does not explicitly say that this product prevents known malware from downloading. If the software doesn't stop known beasties from downloading onto my computer, I've absolutely no interest in what it does next. Emsisoft admits, uncharacterstically accurately, that once malware is on your machine more often than not it can't be removed. Several online reviews, see below, give Emsisoft a low rating for ability to remove viruses it finds on your computer, relative to other software.

EAM is set by default on "scan files when created or modified" (a average level between performance and security), if you set it to "scan files when they are read" , malwares will be blocked at the downloading.

Removal is for me not the main characteristics i look for in my main AV, i rather prefer an high prevention capability than a super removal one. There is no need to remove when you are not infected.

To remove a potential infection, i rather use MBAM, HMP, Combofix, or other specialized softwares.


Avast on the other hand blocks known malware from downloading. It's stopped alot of malware from downloading onto my machine and missed one that nothing could identify.

i don't disagree with this.


The Emsisoft web site, which is filled with hype, never actually explicitly lists specifically what this product does and does not do.

i never really read official websites description except the features of the soft, i just download and try the product, so i will have my own unbiased opinion.


I caught the program using a full 500,000 M of RAM. That is way too much, and would hang any computer more than a couple of years old.

never happened on my computers; as i said earlier every system is different. In mine, on idle it use around 10-50mb; when active (scanning /updating), maximum 250-300mb.


The company uses scare tactics. For instance, a prominently displayed article on the web site claims that ransomware will infect even your backup drives, and there won't be anything you can do. Other IT experts are saying that while Ransomware exists adn can do that it is rare and not much of a threat. It's also unclear how Emsisoft would prevent ransomware since it doesn't stop malware from downloading. The theme of Emisoft's current newsletter is their claim that NBC's web sites are infected with malware.

Even you have a malware on your HDD , if you don't execute it, you have few chances to be infected; unless it is a script linked to the malware (like most of the websites infections); actually on my HDD i have the most virulent malwares in a folder but i am not infected because they are not executed.


Emsisoft Antimalware costs twice as much as most other antivirus software, and you have to buy a second product for sandboxing, which Avast's standard price product includes.

That is nothing to do with the product performance, it is a company orientation; in all my review i put "paid" as a cons because i like free things.
I like Avast (as Comodo) for the complete free stuff they offer; but some companies like Emsisoft are smaller and can't afford to give a full solution for free (and some very big vendors like Norton or kaspersky don't even give anything free)


As far as a debate here about possible favoritism, anytime a web site gives software an unqualified review, and particularly if it's terrible software, I really have to wonder.

http://www.pcmag.com/article2/0,2817,2364196,00.asp

http://fileforum.betanews.com/detail/Emsisoft-AntiMalware/1151054587/1

Honestly i don't care about any tests labs and magazine reviews; i just mind about my forum's co-members and my own experience with it.

Taking Avast for example, i always had some issues (Safezone, Behavior Shield) or bugs (alert popup's link not working); EAM never gave me any issues and i was never infected while using it. It is not means that i hate Avast for that or i says it is a badly done product, i am waiting a proper bug-fixed release of v8 and especially when Agnitium Firewall will be integrated.

Your experience is personal and may greatly differs from someone else experience (like mine).

Some people hate potatoes it doesn't means that potatoes are bad.

Anyway thanks to your comments, every opinions is good to know.
 
D

Deleted member 178

Thread author
Littlebits said:
Emsisoft Anti-Malware 7 is an excellent product outside of all of the false positives.

The only thing worse than a product with low detection rate is a product with high false positives. False positives can cause more problems then many infections can.

does my system is supernatural? i heard many comments about that , but i have never encounter any FPs yet.
 
P

Plexx

Thread author
Littlebits said:
Emsisoft Anti-Malware 7 is an excellent product outside of all of the false positives.

Good review, however I would have gave it 4 stars because of the false positives. The only thing worse than a product with low detection rate is a product with high false positives. False positives can cause more problems then many infections can.

Thanks.:D

Considering the switch from Ikarus to BD engines, the rate of FP did decrease quite a bit and it is worth mentioning it, specially when comparing such product to previous versions.

There are some false positives but like any vendor, there are occasional FPs, but as long as they correct it in time, it is all good.
 

Littlebits

Retired Staff
May 3, 2011
3,893
Biozfear said:
Littlebits said:
Emsisoft Anti-Malware 7 is an excellent product outside of all of the false positives.

Good review, however I would have gave it 4 stars because of the false positives. The only thing worse than a product with low detection rate is a product with high false positives. False positives can cause more problems then many infections can.

Thanks.:D

Considering the switch from Ikarus to BD engines, the rate of FP did decrease quite a bit and it is worth mentioning it, specially when comparing such product to previous versions.

There are some false positives but like any vendor, there are occasional FPs, but as long as they correct it in time, it is all good.

The false positives have improved very much but they are still too many.
If you install a few open-source programs from Sourceforge that are not that popular, Emsisoft will nail almost every one of them. It also nails almost all of NirSoft Utilities because of the BitDefender engine.

It falsely detected several AMD system files and several ASUS tools on my system.

It still doesn't like BitTorrent apps either, detects most of them.

Enjoy!!:D
 
D

Deleted member 178

Thread author
Littlebits said:
If you install a few open-source programs from Sourceforge that are not that popular, Emsisoft will nail almost every one of them. It also nails almost all of NirSoft Utilities because of the BitDefender engine.

They are flagged right away as malwares and quarantine them or the BB's shows a popup for a answer?

For Nirsoft almost all AVs flagged them as malicious, because those tools can be used by attackers.
 

Littlebits

Retired Staff
May 3, 2011
3,893
Umbra Corp. said:
Littlebits said:
If you install a few open-source programs from Sourceforge that are not that popular, Emsisoft will nail almost every one of them. It also nails almost all of NirSoft Utilities because of the BitDefender engine.

They are flagged right away as malwares and quarantine them or the BB's shows a popup for a answer?

For Nirsoft almost all AVs flagged them as malicious, because those tools can be used by attackers.

I'm not sure exactly how the real-time components detect them since I'm just using the free version for on-demand scans. But when I run an on-demand scan most are detected as Trojans and suggested to quarantine them. I'm sure the real-time components would detect them as well probably the scanner itself.

The AMD and ASUS files are digitally signed, so I don't know why they are detected unless Emsisoft doesn't check files for digital signatures. I did report them so maybe they will be removed from detection.

The same files are also detected by Avira and BitDefender. I will have to do another scan and see if the files are still detected later.

Enjoy!!:D
 
D

Deleted member 178

Thread author
Littlebits said:
I'm not sure exactly how the real-time components detect them since I'm just using the free version for on-demand scans. But when I run an on-demand scan most are detected as Trojans and suggested to quarantine them. I'm sure the real-time components would detect them as well probably the scanner itself.

In that case, yes; the only thing that may differs with the paid version, will be the cloud reputation feedback from the BB.

The AMD and ASUS files are digitally signed, so I don't know why they are detected unless Emsisoft doesn't check files for digital signatures. I did report them so maybe they will be removed from detection.

maybe you should tell it on the support forum, there is a FPs section.
 
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top