Jump to content

Leaderboard

Popular Content

Showing content with the highest reputation since 10/13/09 in Posts

  1. Note: It is recommended to make a backup of all important files before using the decrypter. Link to decrypter download page. <- The decrypter will tell you if your files are decryptable, whether you're dealing with an "old" or "new" variant of STOP/Djvu, and whether your ID is online or offline. Link to instructions for using the decrypter (PDF). Link to "file pair" submission form. Link to more information about the decrypter. <- Article at BleepingComputer.com Link to more detailed information about STOP ransomware (covers more than just STOP/Djvu). <- Forum post at BleepingComputer.com Can I report this encryption of my files as a crime? Yes. Distribution of malicious files and holding property for ransom are criminal acts in many countries, and we encourage all victims to report such incidents to the national law enforcement in the country where they reside as this helps them determine how best to prioritize investigations into such criminal activity. There is a list of national law enforcement agencies who are participating in the No More Ransom project at the following link with information on how to file a report (if you live in a country not on the list then feel free to report the incident to your local law enforcement): https://www.nomoreransom.org/en/report-a-crime.html Someone says they can decrypt my files, but I will have to pay them. Is this safe? Such individuals or companies are either scam artists, or they are paying the ransom without telling you and overcharging you for it. Either way we recommend avoiding any contact with those who claim they can decrypt your files for a fee. How do I remove the ransomware? The STOP/Djvu decrypter will stop the ransomware from running so that it can't continue encrypting your files, however it doesn't completely remove the ransomware. Most Anti-Virus software will detect STOP/Djvu if you run a scan for it, however if you don't have Anti-Virus software installed then you can run a Malware Scan with Emsisoft Emergency Kit (free for home/non-commercial use). Note that formatting the hard drive and reinstalling Windows will also remove the infection, however this ransomware is particularly easy to remove, so if a computer is only infected with STOP/Djvu then formatting the drive would be unnecessary. Will removing the infection unlock my files? No. Your files are encrypted. This encryption needs to be reversed (via a process called "decryption") before your files will be usable again. This encryption cannot be removed or undone simply by removing the STOP/Djvu ransomware infection. The decrypter can't decrypt my files? In most cases this means you have an online ID. It could also mean your files were encrypted by a newer variant of STOP/Djvu. See below for explanations. Why won't the decrypter run? The decrypter requires version 4.5.2 or newer of the Microsoft .NET Framework, so this could mean your version of the .NET Framework is out of date. We recommend installing the latest version of the .NET Framework (4.8 at the time of writing this), and then trying the decrypter again. What does "Remote name could not be resolved" mean? This can happen if your computer isn't connected to the Internet. If your Internet connection is working, then it can also be an indication of a DNS issue, and we recommend you reset your HOSTS file back to default if everything else seems fine. Microsoft has an article about this at the following link: https://support.microsoft.com/en-us/help/972034/how-to-reset-the-hosts-file-back-to-the-default Why is the decrypter stuck on "Starting"? When you run the decrypter, it looks for encrypted files. It will say "Starting" until it is able to find some. If the decrypter remains stuck on "Starting" for a long period of time, then this means it is unable to find any encrypted files. Offline ID. When the ransomware can't connect to its command and control servers while encrypting your files, it uses a built-in encryption key and a built-in ID. Offline ID's generally end in t1 and are usually easy to identify. Since the offline key and ID only change with each variant/extension, everyone who has had their files encrypted by the same variant will have the same ID and the files will be decryptable by the same key (or "private key" in the case of RSA keys). Online ID. In most cases the ransomware is able to connect to its command and control servers when it encrypts files, and when this happens the servers respond by generating random keys for each infected computer. Since each computer has its own key, you can't use a key from another computer to decrypt your files. The decrypter is capable of working around this with older variants as long as it has some help, however for newer variants there is nothing that can be done to recover files. Old Variants. Old variants were those in distribution until near the end of August, 2019. Our decrypter supports offline ID's for almost all older variants, and can decrypt files for those with offline ID's without needing any help. For online ID's, it's necessary to supply file pairs to our online submission form so that the decrypter can be "trained" how to decrypt your files. A list of extensions from older variants can be found at the bottom of this post. Is it possible to change an online ID into an offline ID? Your files' ID serves to identify which private key is needed to decrypt your files. If you were to somehow change the ID that was added to your encrypted files, then all you would accomplish is making it impossible to decrypt your files at all, even if you paid the ransom. It is imperative that you don't attempt to modify your encrypted files if you want to make sure that they can be decrypted some day. New Variants. These use more secure RSA keys which are impervious to most types of attacks. Support for some offline ID's has been added to the decrypter for newer variants, and support for new offline ID's will be added as we are able to figure out private keys (decryption keys) for them. As for online ID's, due to the usage of RSA keys, there's currently nothing the decrypter can do to help recover files. How long does it take to add support for new offline ID's to the decrypter? Private keys for offline ID's are donated by victims who paid the ransom, and there is no way for us to be able to estimate when this will happen. If you have an offline ID then try running the decrypter once every week or two, and if we have been able to add the private key for your ID then it will start decrypting files. Will it ever be possible to decrypt new variants with online ID's? That depends on whether or not law enforcement is able to catch the criminals who are behind this ransomware. If law enforcement is able to catch them and release their database of keys, then we can add those to our database for decryption. Are there any ways to recover/repair files that can't be decrypted? In most cases this is not possible, however there is a tool called DiskTuna that can help repair some videos that have been encrypted. This tool was made by a third-party, and they are not affiliated with us, however one of our developers has verified that it does work in at least some cases. You can find more information at this link. What is a file pair? This refers to a pair of files that are identical (as in they are the exact same file), except one copy is encrypted and the other is not. Our decryption service can analyze the differences between an encrypted file and an original unencrypted copy of the same file, allowing it to determine how to decrypt that type of file. For most victims with an older variant of STOP/Djvu, submitting file pairs will be the only way they will get their files back. File pairs only work for one type of file. Due to the way encryption works in STOP/Djvu, file pairs can only help the decryption service figure out how to decrypt one type of file. For instance, if you submit a file pair for an MP3 file, then the decrypter will be able to decrypt all of your other MP3 files, however it won't be able to decrypt any other type of file. There are some exceptions to this, such as certain newer Microsoft Office documents (such as DOCX and XLSX) since those files are technically ZIP archives. The decrypter can't decrypt all of my pictures even though I submitted file pairs for them? JPEG/JPG images have a format oddity that causes file pairs to be specific to each source of pictures, rather than the file format in general. As an example, if you have pictures from two different cameras, and submit a file pair from the group of pictures from one of the cameras, then the decrypter will only be able to decrypt files from the camera that the file pair came from. In order to decrypt all JPEG/JPG images, you will need to submit file pairs from every source you've obtained those pictures from. Extensions from older variants that the decrypter supports:
    13 points
  2. Official word is, "yes". We will give free license extensions to anyone who upgraded to Windows 10 and was unable to use the firewall. Once the issue has been resolved, please either submit a support ticket in our helpdesk system, or send a Private Message on the forums to me (English Support) or Thomas Ott (English/German Sales). Be sure to mention that you would like to have your license extended due to the Windows 10 issues and include in your message any license keys that were in use on a computer with Windows 10. Feel free to link to this forum post if you would like to.
    7 points
  3. As announced earlier, we are changing our firewall strategy and will soon merge Emsisoft Internet Security with Emsisoft Anti-Malware, effective as of our next release in October. Instead of developing our own firewall module, we’re going to rely on the built-in Windows Firewall core that has proven to be powerful and reliable. Its only weak point is the fact that anyone can freely change the firewall configuration. In other words, if malware manages to run on the PC with sufficient administrator permissions, it’s able to allow itself to get through the firewall. To resolve this vulnerability, we’ve developed a new Firewall Fortification feature for Emsisoft Anti-Malware’s Behavior Blocker as part of our 2017.8 release. Firewall Fortification detects and intercepts malicious actions from non-trustworthy programs in real time before they can cause any damage. Behavior Blocker alert: Firewall manipulation All 2017.8 improvements in a nutshell Emsisoft Anti-Malware New: Firewall Fortification feature that blocks illegitimate manipulations of Windows Firewall rules. Improved: Forensics logging. Fixed: Rare program freezes on opening the forensics log, confirming of surf protection notifications and during malware detection. Fixed: Computer restart instead of computer shutdown executed, when set for a silent scan. Several minor tweaks and fixes. Emsisoft Enterprise Console Improved certificate handling to avoid connectivity issues. Several minor user interface improvements. Several minor tweaks and fixes. How to obtain the new version As always, so long as you have auto-updates enabled in the software, you will receive the latest version automatically during your regularly scheduled updates, which are hourly by default. New users please download the full installer from our product pages. Note to Enterprise users: If you have chosen to receive “Delayed” updates in the Update settings for your clients, they will receive the new software version no earlier than 30 days after the regular “Stable” availability. This gives you time to perform internal compatibility tests before a new version gets rolled out to your clients automatically. Have a great, well-protected day! View the full article
    6 points
  4. Ransomware infections are unique in many ways. Most importantly, a lot of the natural instincts which are usually correct when dealing with malware infections can make things worse when dealing with ransomware. Please see the following steps as a guideline when dealing with your ransomware infection. Do not delete the ransomware infection The natural instinct of most users is first to remove the infection as quickly as possible. This instinct is, unfortunately, wrong. In most cases, we will require the ransomware executable to figure out what exactly the ransomware did to your files. Finding the right ransomware sample becomes infinitely more challenging when you deleted the infection and can't provide us with the ransomware. It is okay to disable the infection by disabling any autorun entries pointing to it or by quarantining the infection. However, it is important not to delete it from quarantine or to remove the malicious files right away without a backup. Disable any system optimisation and cleanup software immediately A lot of ransomware will store either itself or necessary files in your temporary files folder. If you do use system cleanup or optimisation tools like CCleaner, BleachBit, Glary Utilities, Clean Master, Advanced SystemCare, Wise Disk/Registry Cleaner, Wise Care, Auslogics BoostSpeed, System Mechanic, or anything comparable, disable those tools immediately and make sure there are no automatic runs scheduled. Otherwise, these applications may remove the infection or necessary ransomware files from your system, which may be required to recover your data. Create a backup of your encrypted files Some ransomware has hidden payloads that will delete and overwrite encrypted files after a certain amount of time. Decrypters may also not be one hundred percent accurate, as ransomware is often updated or simply buggy and may damage files in the recovery process. In those cases, an encrypted backup is better than having no backup at all. So we urge you to create a backup of your encrypted files first, before doing anything else. Server victims: Figure out the point of entry and close it Especially recently we have seen a lot of compromises of servers. The usual way in is by brute-forcing user passwords via RDP/Remote Desktop. We firmly suggest you check your event logs for a large number of login attempts. If you find such entries or if you find your event log to be empty, your server was hacked via RDP. It is crucial that you change all user account passwords immediately. We also suggest to disable RDP if at all possible or at least change the port. Also, it is important to check all the user accounts on the server, to make sure the attackers didn't create any backdoor accounts on their own that would allow them to access the system later. Figure out what ransomware infected you Last but not least it is important to determine what ransomware infected you. Services like VirusTotal, which allows you to scan malicious files, and ID Ransomware, which lets you upload your ransom note and encrypted files to identify the ransomware family, are incredibly useful and we will probably end up asking you for the results of either of these services. So by providing them right away, you can speed up the process of getting back your files. If you struggle with any of these points, please feel free to ask for help. Our ransomware first aid service comes with no-strings-attached and is free for both customers and non-customers.
    5 points
  5. Guten Tag, Wir haben mittlerweile mehrfach etabliert, dass Emsisoft nicht das Programm Ihrer Wahl ist. Sie haben sich bereits anderweitig ein Antivirus gesucht, dass auch noch dreißig weitere Funktionalitäten mitabdeckt. Fakt ist jedoch, dass viele Leute eben auch ein Antivirenprogramm suchen, dass nicht noch fünfzig Extras mitbringt, die man nicht will oder nicht braucht. Für diese Leute gibt es eben Emsisoft Anti-Malware und die meisten unserer Kunden sind mit der Tatsache, dass es eben 'nur' ein Rundumschutz für den Rechner ist und nicht mehr, zufrieden. Für all die angesprochenen Features - Passwortgenerator, Kinderschutz, etc - gibt es bereits gute Programme, die man sich bei Bedarf installieren kann. Viele Leute haben aber entweder keine Kinder oder wollen diesen den Zugang nicht beschränken, warum sollten wir diesen Leuten einen Kinderschutz mitinstallieren. Einige haben eben auch nicht RAM oder CPU im Überfluß, für diese Leute ist es noch ärgerlichr wenn das RAM durch ein AV belegt ist, dass aufgrund von ungenutzten Features die Ressourcen auffrisst. Fazit: Es gibt viele Antivirenprogramme, die die eierlegende Vollmilchsau sein wollen und versuchen alle Programme in einem zu vereinen. Es gibt User, die diesen Ansatz nicht mögen und nur ein Antivirenprogramm wollen. Nicht mehr. Für diese Leute gibt es, zum Beispiel Emsisoft Anti-Malware. Sie gehören nicht zu dieser Gruppe und das ist ok. Mit freundlichen Grüßen Kathrin
    4 points
  6. Which for everything related to our core technologies (engine, behavior blocker, cleaning engine) would be me. Hi, nice to meet you! Next time someone looks strange at me for talking to myself I can now point them to this post and tell them you asked me to talk to me . Your argument is that we chose Bitdefender because it is "the best". Both Kaspersky as well as Avira consistently score higher in pure on-demand tests than Bitdefender does. If you consider PUP detection ESET is a superior contender as well. We considered all of them at one point or another but they were discarded for various reasons. The article is based on the submission we got through the "Submit information about detected Malware" option in all our products, which reports back meta data (infection names, number of infected objects) about all infections found by our products.
    4 points
  7. Actually, there is a system behind it: My workstation computers are named after noble gases, like Krypton or Helium. Computers that I only use temporarily or belong to guests are named after transition metals like Titanium. Non-computer devices like smartphones are named after non-metals like Oxygen. All systems and VMs that are used for malware testing are named after radioactive elements like Uranium. Needless to say my WLAN and local workgroup is called "Periodic Table". And yes, I spent a significant amount of time coming up with that system and I am proud of it .
    4 points
  8. You've not yet adequately answered my questions. I have however noticed that EAM hasn't nagged me recently; does that mean that someone's tweaked the code to stop the nagging, or is it just coincidence (since the nags seemed to be at irregular intervals)? If the nagging is going to continue, then please explain once and for all WHY this authentication is needed for a user who is not using the website-based console. Please also address all the other points I've raised here, namely: - the possibility (if there's not multiple instances) that your backend server is a single point of failure - the possibility (if someone manages to hack into those server(s)) of the security of customers' systems being at risk. I'm sure you won't have forgotten that an Emsisoft server was breached in Jan-Feb 2021. I know that was reported as a fairly minor data leak, but that doesn't mean that other kinds of breach are impossible. I wonder how much thought Emsisoft have given to how they'd mitigate effects (on customers' systems) if such a breach were to occur. And, do you run disaster-recovery tests on your infrastructure? If eg a data-centre which houses your servers burns down (as did OVHcloud, Strasbourg, France, in March 2021) how long will your customers be affected for? - the point about the website console, if one chooses to change to "Local Only" resetting my (private) PC's EAM configuration to default - two problems there: why would it reset anything, and secondly how/why (if my PC is not authenticated to the workspace) does it have the right to perform a reset? - the tooltip text for the "Local Only" option I do not think I have muddied the waters with conjecture. But note that "conjecture" means speculation based on inadequate information. The very fact that I've been asking the initial question here (about the nagging) over and over again without a proper answer being given has not helped. Questions about single points of failure etc might have been less relevant before when your customers' systems were less tightly integrated with your servers; I mean all of us could cope with occasional absences of signature updates. But centralised control of our copies of EAM by your servers considerably heightens risk for customers. I would like you to understand that I ask about these things based on my professional experiences in a UK bank's datacentre.
    3 points
  9. Everything is clear, except the parts that are in Russian. I'm going to send you a private message with some instructions.
    3 points
  10. Hello @SalasKafa, Thank you for contacting Emsisoft Support. TOPI is a newer variant of the STOP/DJVU family of ransomware and is not supported by our decryption tool. Any ID ending in t1 is an Offline ID anything else is an Online ID. This is important as it tells us how the encryption key was generated. There may be multiple Ids, especially if communication between the target system and the command & control server is interrupted for any reason, or because the file encryption was done in stages to avoid detection. An Offline ID means that the encryption key pair was generated locally and the encryption key is encoded in a file. An Online ID means the encryption key pair was generated and stored on a remote command & control server under the control of the ransomware gang responsible for encrypting your files. Why is this important? The ID of the file(s) is how private encryption keys are identified. If we have a private encryption key matching the ID for a file(s) then that can be used to decrypt the file(s). However, this is all contingent on us having a matching private encryption key in our database. The downside of all this is that we are not currently in possession of private encryption keys for the TOPI variant of STOP/DJVU.
    3 points
  11. It means that the tests done by AV-C and AV-T have a clear image of how they think AV software should work. The problem arises when your product doesn't fit the mould. Then you get penalized for not doing what everyone else does, even though what everyone else does may not be in the best interest of the user, to begin with. Best example: Snooping around in your encrypted connections, which literally every AV vendor screwed up at least once in the past and probably will continue to happen, exposing users to potentially greater risks than most malware does. For starters, the test sets aren't nearly as representative anymore. When we participated in AV-T and AV-C both tested with less than 200 samples a month on average. 200 samples out of literally tens of millions. The exact selection isn't clear and not representative of what users deal with either. None of them tests with PUPs for example, even though a simple look at any tech support community will tell you, that it is probably by far the biggest problem users are dealing with. So no, neither of those test scores represents real-life performance and it becomes blatantly obvious when you go to places like Bleeping Computer, GeeksToGo, Trojaner Board, Malekal, and all those other communities where people infected by malware show up for help and look at what products these victims used at the time they became infected. Then you will notice that a lot of these products with perfect scores don't look nearly as perfect in real-life conditions. The reason for this discrepancy is quite simple: Most AV vendors will specifically optimise their products for these tests. The most severe cases are where vendors end up outright cheating and detecting the test environments which then results in a change of behaviour of the product (think Dieselgate, but with anti-virus). But there are many ways you can game these tests. For example: you can try to figure out the threat intel feeds the companies use, then just buy those same threat intel feeds so you have all samples in advance you can track their licenses and supply different signatures to them or use your cloud to treat those test systems differently some particularly shady organisations literally also sell you their sample and malicious URL feed, so you can just outright buy the samples and URLs your product will get tested on later What you end up with as a result is a product that is optimised really really well for the exact scenario they are being tested under using the exact type of URLs and samples these testers use, but that is utterly useless when it comes to anything else. We just really don't want to create this type of product. So when we were asked whether we wanted to continue to participate this year, we discussed the matter internally, looked at what we get out of these tests (meaning: whether these tests have a discernable impact on our revenue) and decided that they are simply not worth it and that the tens of thousands of Euros we spent on them every year would be better spent on extending our team and building new ways of keeping our customers safe.
    3 points
  12. Please note that Emsisoft Anti-Malware for Windows XP hasn't been updated (as in program updates) in over 2 years, and we never intended on continuing long-term database update support for it. In fact, we discontinued our own database updates for it over a year and a half ago, and those still running Emsisoft Anti-Malware on Windows XP have only been receiving BitDefender database updates. We've decided that it is time to stop redistributing those BitDefender updates for Windows XP, as all they are doing is giving those on Windows XP a false sense of security. In addition, it is extremely dangerous to continue using Windows XP. It has (for several years now) had well-known and major security vulnerabilities that Microsoft will never fix. These vulnerabilities make it trivial to infect a Windows XP system, and there is no security software in the world that is capable of preventing it. We can not, in good conscience, continue to provide any support for this version of Windows, as we announced on December 31st, 2015: https://blog.emsisoft.com/2015/12/02/why-we-believe-its-not-ethical-to-sell-antivirus-software-for-windows-xp-any-longer/ We highly recommend that you upgrade to a newer Operating System that is still supported. It doesn't matter if that's a newer version of Windows, or something free like Linux or BSD, as long as you'll be receiving security updates from whoever makes it. New vulnerabilities are discovered almost every day for every major Operating System (Windows, Linux, BSD, MacOS, Android, etc) so it is absolutely critical that you are able to receive security updates from whoever made the Operating System to help keep you and your data safe.
    3 points
  13. Wenn alle Features eingebaut würden, die Galaxy wünscht, dann würde ich EAM sofort deinstallieren. Ich mag das Programm so wie es ist und hoffe, das bleibt auch so.
    3 points
  14. Is this working OK now for everyone else? If it is, then there's no need for any more logs. All we needed was a traceroute to send to our CDN provider to help in identifying the server that was having the issue, and I managed to get one of those the other day.
    3 points
  15. @achtsam Es wird eher langsam Zeit, dass Du deinen privaten Kreuzzug einstellst. Das nimmt ja wirklich paranoide Züge an.
    3 points
  16. Hello, a2guard.exe is the visible protection process (to put it simple, the Emsisoft icon you see in the system tray). However actual protection drivers start a lot earlier. For example epp.sys (the Emsisoft Protection Platform driver) starts very early in the Windows boot process in order to ensure a protected system even when no user is logged in yet and no other programs have been started.
    3 points
  17. Today, we've received information that our Dutch team member Rob R. passed away yesterday afternoon, after suffering from an unexpected heart attack last Wednesday. Rob was our lead software tester and we always admired him for his special eye to track down the most tricky bugs. He joined our team more than five years ago by voluntarily sending over a brand new and complete Dutch translation of our software. Shortly after he initiated our efforts in offering physical delivery of our software on CD boxes and USB sticks. He also demonstrated a great interest in testing security software which recently led him to becoming our lead tester for Emsisoft Anti-Malware and Emsisoft Internet Security. Rob will truly live on in our memories as a valued team member and friend.
    3 points
  18. Hardik587 You are indeed becoming most wearisome. There is an old expression among diehard Texans. "No matter how much you kick a dead horse it won't get up" This is exactly what you are doing.
    3 points
  19. Hello, please send me your license key via PM (personal message). I will add some days to your key as a sign of goodwill.
    3 points
  20. Our recommendation is to save a backup of your encrypted files and keep it in a safe place in case decryption is possible at some point in the future. We also recommend keeping an eye on BleepingComputer's newsfeed, as they will usually report on new developments with ransomware decrypters: https://www.bleepingcomputer.com/ If you have an RSS feed reader, then they also have an RSS feed so that you don't have to manually check for news: https://www.bleepingcomputer.com/feed/ There is no way to know for certain, however it is theoretically possible that someone may be able to obtain private keys for decryption. Unfortunately it isn't possible to know if or when that may happen.
    2 points
  21. Hello. Information was sent to virus monitoring team, please, wait for reply. I received such a message from Dr.Web specialists. They are working on decryption.
    2 points
  22. I must say more precisely -> You trust Emsisoft Personally, I only help a little to unmask the ransomware.
    2 points
  23. Such tests aren't reliable. They aren't actually malicious, and may not be blocked by our Behavior Blocker like real ransomware would.
    2 points
  24. I am running decrypter in every 2 days. I hope...! I will have my files decrypted one day soon. I hope...! :) Thank you
    2 points
  25. @Kevin Zoll @GT500 Just tried using STOP djvu decryptor a while ago and my files were successfully decrypted. Thank you so much Emsisoft Team. 😭
    2 points
  26. Hello All! I return to the topic) Obviously, the problem was in the AdGuard WFP-driver. EAM has nothing to do with this situation! After changing the network settings in AdGuard, the problems with the tcpip.sys have not yet recurred! At least - a little over 10 days already😉
    2 points
  27. We just added the private key for .reha offline ID's on Thursday, which is why it suddenly was able to decrypt your files. Thanks for letting us know that it worked. 👍
    2 points
  28. @SalasKafa Try running the decryptor again; we may have just received a key for that ID recently. 😉
    2 points
  29. FYI: https://blog.emsisoft.com/en/32110/emsisoft-anti-malware-2018-9-beta/
    2 points
  30. If you’re a regular reader, you’ve probably noticed that something has changed about our blog… That’s right: everything has changed. When we started the original blog more than a decade ago, little did we know how popular it would become. From a few hundred visits per month back in 2004 to more than 100,000 now, the Emsisoft Security blog has become a major destination for people looking for straight-talking security advice from our team of malware and online security experts. Sadly, while the actual articles have progressed in leaps and bounds since the early days, the blog page itself has received little love and was starting to feel inadequate for the breadth of content we are now offering our readers. We decided to change that and embarked on the biggest redesign of our blog ever. After lots of brainstorming and gathering feedback, we are excited to show you what we’ve been working on and hope that it will make discovering, exploring and sharing our content even better. So, go ahead and check out our redesigned security blog now, or read on about the exciting changes you can look forward to. See what’s new Without further ado, below are some key highlights from the many improvements we have made to your Emsisoft Blog experience: Home page Visitors to Emsisoft’s Blog will now be greeted by a clearly structured home page, with a prominent “Featured Article” chosen by the team to highlight the latest insights into online security. The page itself is divided into clear categories with a selection of the latest articles for each, so it’s easy to browse through each section and dive into those that you find most interesting. From the latest videos, to Protection Guides and Enterprise Security, there’s something for every security-conscious reader. Category pages All posts are now grouped into clear categories and can be accessed from any part of the blog using the new category menu. Each main category page has been designed with a clear purpose and provides an intuitive way to browse the most relevant articles. While the Emsisoft News articles are organized in a timeline, the Protection Guides are grouped by topic to allow you to find the most relevant information in one place. Go ahead, have a look around! Readability First and foremost, a blog should be a pleasure to read. Once you’ve found what you’re looking for, reading should be a pleasant, distraction-free experience. We have reduced the clutter around the actual article text and adjusted the layout and typeface, creating the feeling of reading a high-quality book, whether it’s on a desktop or on your mobile phone on the go. Quick Search Find any article in a matter of seconds with our new search function. With hundreds of online security articles published over the years, our completely new search functionality makes finding that one article about ‘ransomware payment methods’ a breeze. Simply click on the magnifying glass in the header to bring up the search box, start typing and results will appears instantly. Sharing Options To achieve our ultimate goal of a malware-free world, it’s critical to share our insights and security advice with as many people as possible. We’ve now made it easier than ever to share articles or even sections of articles via social media or email: simply click on your favorite social network on our new sharing menu on the left-hand side to share the whole article with your friends and colleagues, or select a particularly insightful sentence or paragraph and share it via the new context menu that appears. We want to hear from you This article only touches the surface of all the changes we’ve made for you in our new Emsisoft Security blog, and we plan to continue developing it over the coming months. As excited as we are about the improvements, ultimately we have made them for you, our readers and customers. Let us know what you think about the new design, the functionality and the reading experience. The post Welcome to the all-new Emsisoft Security Blog appeared first on Emsisoft | Security Blog. View the full article
    2 points
  31. You can see this on several programs. Service and drivers are up, but GUI hasn't caught up. It's not a problem.
    2 points
  32. Emsisoft Anti-Malware is compatible with the Windows update. We also just published an update that sets the compatibility flag for all users of the beta, stable and delayed update feed. Keep in mind, that Microsoft uses the same flag for all anti-virus vendors. That means if you are using multiple anti-viruses or anti-malware applications, you are risking one of those products, like Emsisoft Anti-Malware, flagging the system as compatible, even though one of your other products is not compatible. There is, unfortunately, nothing we can do to prevent this as Microsoft does not account for the scenario of multiple security products being installed on the same system. This is the perfect example why we are recommending against using multiple security products in parallel. For further information, feel free to stop by our blog.
    2 points
  33. Thanks Umbra. I've also done step 2, and I suspect your right that is good enough.
    2 points
  34. Starting 1 October 2017, Emsisoft Internet Security will be merged with Emsisoft Anti-Malware. While this may come as a bit of a surprise, there are many factors that have prompted this decision, and I would like to use this as an opportunity to share our reasoning: A common base Technically, both products have shared the same code base and even the same file feeds for online updates for the last couple of years. From a branding perspective, Emsisoft Internet Security has kind of been framed as an extended feature set edition of Emsisoft Anti-Malware. The only difference between the two products is Emsisoft Internet Security’s built-in firewall component, which is responsible for its slightly higher price tag. While Emsisoft Internet Security was definitely a valuable product in years gone by, we believe that whatever protective advantages desktop firewalls once had over Windows Firewall are now minimal, if not negligible. The job of firewalls The main purpose of a desktop firewall is to shield your computer from attacks from the Internet. It does so by interrupting network communications initiated by foreign computers when they attempt to connect to a program that listens for input on your computer. However, there are two things to consider here: Most attack attempts from the outside are made impossible by the use of NAT routers (which includes just about every modern DSL modem), as they separate your inside network (LAN) from the Internet. The built-in Firewall in Windows 7, 8 and 10 already does a pretty good job of blocking connection attempts from potentially dangerous computers that reside in the same network (e.g. in public WiFi) or on the Internet. Malware and firewalls We see our main job as protecting your computer from malware – and today’s malware is generally quite unimpressed by firewalls. Connection attempts from the outside in are blocked by the Windows Firewall by default, and connections from the inside out are prevented by Emsisoft’s multi-layer real time protection, and the Behavior Blocker in particular. Emsisoft Firewall vs Windows Firewall When Microsoft introduced the Windows Firewall in a late Windows XP Service Pack update, it was a bit of an embarrassing performance and the software could not be taken too seriously, which led us to build a stronger alternative. But with the release of Windows 7, the Windows Firewall started to do its job much more effectively, and the latest Windows 10 version pretty much does everything you could expect from a desktop firewall. Its only architectural flaw is that its settings (and firewall rules) can be freely edited by anyone or anything that attains the required permission level. In other words, if malware manages to run on the PC, it’s able to allow itself to get through the firewall. That was one of the main reasons for us to maintain our own firewall component. A better approach: Fortifying the Windows Firewall Emsisoft Internet Security has always been highly configurable. While some of our more technically minded users might have appreciated the freedom to tweak settings to their heart’s content, it has to be said the majority of our customers are (understandably!) not familiar with the technical intricacies of firewalls and were not always confident when using the software. This was problematic given the fact that a wrong configuration can potentially cause a lot of damage when it comes to malware protection. So, in the interests of protecting our customers, we thought it would be most beneficial if, moving forward, we simply rely on the Windows Firewall and use our software to cover its blind spot and ensure its settings can’t be manipulated by malware from the inside. How are we going to do that? Well, one of Emsisoft’s key strengths is creating Behavior Blocking technology that works. It allows us to detect and intercept malicious actions from active programs in real time before they can cause any damage. This technology now allows us to define behavior patterns that indicate illegitimate manipulations of Windows Firewall rules. We make sure Windows Firewall is as safe to use as our own firewall, so we can remove the redundancy of building and maintaining our own firewall code. Therefore, we decided to end the product life-cycle of Emsisoft Internet Security and merge it with Emsisoft Anti-Malware, which receives the Windows Firewall fortifying enhancements in the version 2017.8 release. Timeline September 1st, 2017: The new Windows Firewall Fortify feature will be part of the version 2017.8 release of Emsisoft Anti-Malware. October 1st, 2017: Existing Emsisoft Internet Security software will directly update to Emsisoft Anti-Malware version 2017.9 and the remaining license period will be extended as described below. No manual actions required. Advantages for Emsisoft Internet Security customers We appreciate that the decision and swift merging will come as a surprise to our loyal customers, so apart from the additional features already mentioned that ensure capable and secure firewall protection, we are sweetening the transition for existing Emsisoft Internet Security license holders: By switching to Emsisoft Anti-Malware, your annual software license fee gets about 20% cheaper. To compensate for the already paid higher product price, we will extend all active Emsisoft Internet Security license periods by 50%. E.g. if you have 1 year left on your license, it will change to 1.5 years for free. Malware protection capabilities of Emsisoft Anti-Malware will be improved due to less interference with firewall code. Your Emsisoft protection software will get lighter on the system and there will be fewer incompatibilities with other products. Less risk of misconfiguring the protection features. We hope you think this is a fair deal and will make the transition to our flagship product as smooth as possible. Should you still be unhappy with the upcoming changes, we’re happy to do partial refunds for your remaining license period. As the cybersecurity landscape continues to evolve, we are continuing our mission towards a safer digital world for everyone. Today we have taken an important step in this journey, and we are excited to continue to improve our protection services for our customers. Have a great, malware-free day! View the full article
    2 points
  35. Ah, I see everyone already saw the stable build. You're welcome.
    2 points
  36. It doesn't matter if it is securely transmitted or not. Your browser decrypts the HTTPS traffic when it is received, so the file would be saved in its original form, and our protection would catch it either way. HTTPS (secure connections) are only intended to keep information being exchanged over the Internet private. For instance, if you do a search on your favorite search engine, and the connection to their website uses HTTPS (and thus is secure), then when the NSA records the data that is sent from your computer to the search engine tell it what you want to search for, that data is encrypted, and thus the NSA can't actually tell what you searched for if they were to review the data they had collected (obviously they may have other ways of finding out, but at least they can't get it from the HTTPS traffic). Of course, I'm using the NSA as an example due to the various leaks revealing that they record everything that is transmitted across the Internet. The original purpose of HTTPS was to secure online purchases and other information you submit to websites from criminals snooping on data sent across the Internet. If malware is downloaded over a secure connection, then all it really does is keep anyone from snooping on your Internet traffic (or government agencies recording everything you do online) from seeing what you downloaded. That sort of thing would generally be done either with malicious extensions, or some sort of malicious program on your computer. If there is something malicious on your computer, then everything is compromised, and not just a single tab. Note that most modern browsers (except maybe Firefox) have a sandbox for each tab in the browser, which should isolate the tabs from each other. I have never saw these words before and do not know what they are . ClassicShell is a program for Windows 8, Windows 8.1, and Windows 10 that adds the classic Windows 7 Start Menu to these newer versions of Windows. AmmyAdmin is a remote access software similar to TeamViewer. There are testing organizations/companies that will test websites for security problems periodically, and some website owners will sign up for those services to ensure their websites are secure. With paid services the website owners are usually allowed to put some sort of graphic on their website that links back to the latest test results to allow visitors to verify whether or not the website is secure. If you see one of those graphics on a page, and can click on it to verify that it is valid, then the website is more than likely secure. If there is no such graphic on a website, then there will be no publicly available way to verify the website is secure, however this does not mean the website unsafe. As an example, GT500.org doesn't have a graphic/button/etc. that you can click on to see if the website has been tested, however it is tested weekly for security vulnerabilities by Beyond Security and is almost always given the highest possible score (when it isn't, any security issues are dealt with quickly).
    2 points
  37. Browser Integration (assuming you mean browser extensions) - This sort of thing is generally used to generate revenue by hijacking your browser search settings, or tracking your browsing habits. Since we have no interest in doing such things, and a browser extension wouldn't provide any real increase in security beyond our Surf Protection, File Guard, and Behavior Blocker we don't feel that browser extensions should be bundled with our products. Pop-Up Blocker - Pretty much every modern browser already has a built-in pop-up blocker, so such a feature would just be a gimmick used to drive sales rather than something really useful for our users. Beyond that, there are already popular and safe extensions that supplement web browser pop-up protection, with included ad blocking, that do a rather good job and we tend to recommend those to our users. Password Manager - There are so many password managers these days that any attempt by us to make one would just be a gimmick to drive sales. These days you can use LastPass for free on multiple devices, and sure beats needing to get used to a new password manager when you change your anti-virus software. And if you don't like LastPass, there are others that are just as good, and even one that is open source (although I would believe it lacks an official browser extension). Encryption / Safes (assuming you mean encrypted storage) - Windows has had a built-in encryption tool called BitLocker for about 10 years, although I would believe it is restricted to only certain editions of Windows. In cases where users don't have BitLocker, or simply don't like it, there are free tools such as CipherShed and VeraCrypt (both are updated versions of TrueCrypt) that should fulfill that role reasonably well. Adding such a feature to our own software would also be nothing more than a gimmick. I know I'm starting to sound like a broken record with the word "gimmick", but trying to re-create all of these features that other people already do for free (and do rather well) is really just something anti-virus software vendors do to make their software stand out in the crowd. If they can't drive sales with superior protection, then at least they can wow potential customers in a store with a bunch of extra bullet points on the box. My biggest recommendation is uBlock Origin for your browser, and if it is also available then uBlock Origin Extras. You can also try things like Ghostery if privacy is a major concern for you. We don't generally recommend extra software with real-time protection in addition to our own, however if you feel it is necessary then we recommend no more than two softwares with real-time protection be installed at the same time. If you want on-demand scanners (Malwarebytes Anti-Malware, Hitman Pro, etc) then those should be OK. We issue license keys, similar to a "serial key". They'll be in the form AAA-BBB-CCC-123 (for reference only, that is not a valid license key). I'll have to ask one of our sales representatives about any available discounts, however you may want to take a look at this information about how to get free license time. Spyware and Adware are malicious software, and thus are classified as "malware" (as are viruses, trojans, ransomware, etc). Our software provides protection against all of these as part of its normal functionality through its File Guard and Behavior Blocker. The only thing you will see separate settings for are Potentially Unwanted Programs (PUPs), since these are not real threats we make detection of them optional. There are known compatibility issues with our software and anti-virus software from both Kaspersky and AVG. I recommend avoiding anything from those vendors that includes real-time protection. All I really know about MBAM these days is that it isn't going to detect droppers (trojans that install another infection) for Locky since they are JavaScript, and not executable files. Beyond that, I know very little about its effectiveness or functionality. I'm not familiar with software from Heimdal, so I can't say whether it would be any help with security.
    2 points
  38. Hi LandLord323, Unfortunately, we can't decrypt your files for free. I suggest either making sure you change the RDP password to be more secure or disabling it if you do not use it as that is how they get access. Regards, Sarah
    2 points
  39. Hi, So I think, change the text is better. Thank You!
    2 points
  40. Generell basiert der Mechanismus des Quarantaene Rescans darauf, dass wir Elemente in der Quarantaene nach jedem Update neu scannen. Sollte eine Datei dann ploetzlich nicht laenger erkannt sein, gehen wir davon aus, dass es sich um einen Fehlalarm handelte. Wir justieren Erkennungen konstant. Entsprechend kann es vorkommen, dass insbesondere bei Erkennungen, die von generischen Signaturen ausgeloest wurden, selbst kleine Modifikationen dazu fuehren, dass ein bestimmtes Sample einer Malware Familie nicht laenger erkannt wird. Falls man generell nicht moechte, dass EAM oder EIS die Quarantaene bei jedem Update neu scanned, dann kann man unter Einstellungen/Allgemein den Quarantaene-Scan von "Automatisch" auf "Kein erneutes Scannen" aendern. Haette sie definitiv. Tesla ist im Grunde nicht wirklich neu. Die ersten Versionen gehen auf Mai diesen Jahres zurueck. Das hier wuerde passieren, wenn man versucht TeslaCrypt auf einem von EAM or EIS geschuetzten PC auszufuehren: Sollte man die Cloud Unterstuetzung deaktiviert haben oder in dem unwahrscheinlichen Falle, dass die Cloud das Sample noch nicht kennt, dann bekommt man folgende Warnungen zu sehen: Erst nachdem man jede dieser Warnhinweise ignoriert und die weitere Ausfuehrung erlaubt hat, wird ueberhaupt irgendeine Datei auf dem PC verschluesselt.
    2 points
  41. I would only recommend one Sandboxing program, Sandboxie. I have used it for years, and it works fine with Emsisoft products. When you install it, Sandboxie will detect the presence of Emsisoft products and ask you if you want to enable compatibility settings. You would want to do this. Any questions, feel free to ask. Pete
    2 points
  42. You can go ahead and have EEK safely delete: Value: HKEY_USERS\S-1-5-21-3104866962-3908348715-1408370962-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR detected: Setting.DisableTaskMgr (A) Value: HKEY_USERS\S-1-5-21-3104866962-3908348715-1408370962-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS detected: Setting.DisableRegistryTools (A)Everything else looks good.Unless you are having problems, it is time to do the final steps. Now to remove most of the tools that we have used in fixing your machine: Download Delfix from here and save it to your desktop. Ensure Remove disinfection tools is checked.Also place a checkmark next to:Create registry backupPurge system restoreClick the Run button.When the tool is finished, a log will open in notepad. I do not need the log. You can close Notepad.Empty the Recycle Bin Download to your Desktop: - CCleaner Portable UnZip CCleaner Portable to a folder on your Desktop named CCleanerRun CCleanerOpen the CCleaner Folder on your Desktop and double click CCleaner.exe (32-bit) or CCleaner64.exe (64-bit) Click "Options" and choose "Advanced" Uncheck "Only delete files in Windows Temp folders older than 24 hours" Then go back to "Cleaner" and click the "RunCleaner" button. Exit CCleaner. Turn off System restore to flush all your restore points then turn system restore back on. See How To Enable and Disable System Restore.You can delete and uninstall any programs I had you download, that you do not wish to keep on the system. Run Windows Update and update your Windows Operating System. Install and run the , this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated. Articles to read: How to Protect Your Computer From Malware How to keep you and your Windows PC happy Web , email, chat, password and kids safety 10 Sources of Malware Infections That should take care of everything. Safe Surfing!
    2 points
  43. 2 points
  44. I appreciate the honesty but I hope you understand that a bug like this needs to be fixed on top priority. It prevents the download of critical updates unless the Firewall is deactivated but deactivating the firewall can make the system vulnerable. I mean an issue as critical as this should be treated as soon as possible.
    2 points
  45. Looks like my system is still the fastest: Emsisoft Internet Security - Version 10.0 Last update: 4/12/2015 12:05:17 AM User account: Krypton\Fabian Scan settings: Scan type: Malware Scan Objects: Rootkits, Memory, Traces, Files Detect PUPs: On Scan archives: Off ADS Scan: On File extension filter: Off Advanced caching: Off Direct disk access: Off Scan start: 4/12/2015 12:06:09 AM C:\Users\Fabian\AppData\Roaming\tmpUQC0.exe detected: Trojan.MSIL.Inject (A) Scanned 74807 Found 1 Scan end: 4/12/2015 12:06:27 AM Scan time: 0:00:18 This is the first scan after a cold boot. Later scans go down to 11 seconds .
    2 points
  46. Hi Legend, You bring up a good question, but unfortunately there isn't one answer here. That is because a lot of definitions are being used for the same term. See for example also Fabian's explanation here. For Emsisoft you can just say its about the same thing, just a different term. Behavior blocking or IDS both can have user interaction, its the fact that the program is able to recognize a certain intrusion or behavior that counts, after that its the user or program settings that decide what is actually done with it. The issue is, IDS implies already something malicious is going on. That is sometimes misleading, because not each alert is generated by malware. Behavior blocking covers it better IMO, because it suggests it is behavior that causes an alert, which doesn't necessarily mean this behavior is also malicious (and here community based input plays a role, in Emsisoft products you usually will see that plain malware will be auto-blocked by community input (90% of the users blocked it, so EAM will block it) while questionable or even legitimate programs will respectively prompt for action or be automatically allowed. That system isn't 100% fail safe, but will help quite a bit reducing alerts. Advanced heuristics is really a very general term as well. In most cases (as explained also in the post I linked you to above) it implies some sort of emulation is going on. That sounds quite good, but malware can also protect itself against this type o emulation (and refuse to be executed when it detects emulation for example). Yes, EAM does not use emulation. Again, this is really a generalization, each security program may have their own definitions of these terms and/or use this in their own way. EAM's behavior blocker works quite well as you can also see by observing for example AVC's real world protection tests. In EAM9 some additional functionality has been added (static is nice, but that doesn't mean we're not continuously working to find new ways to block malware as early as possible ). I hope this answers your questions (and didn't cause more confusion).
    2 points
  47. Yes, the setup files support a commandline parameter to change installation directory: /DIR="x:\dirname"
    2 points
  48. Here are the reports. Also, received error report that C:\$mft is corrupt
    2 points
  49. Wow! That would be small thing to forget "ThreatFire"... you mean (?) And?... Please tell if you found the cause related to that. ====== most likely redundant info below Anyway since I prepared some after reading your previous reply I will post it ... even if nothing applies it may help in other situations ======= I am not sure I can see how that related to A-M at the moment from the description, except you are saying that disabling the guard helps. I am not using Vista but I hope that H_D may help to provide Properties info for the standard Notepad and you can do the same. a side note: that may not relate but still … If you search out there there are reports for Vista slow file opening (notepad included) but as I briefly noticed that was in time of SP1 Any reasons that you are still using SP1 but not SP2? You didn't answer the question about the size of files you are opening and whether that matters? Can you try to open any other file with Notepad like .log/ .ini. Will you experience the same effect? Are you using any add-ons / typing enhancements for Notepad? Well, again not really A-M related but there are several things that improve file opening and in Notepad in particular: - try to uncheck Word Wrapping – that really reduces opening time, but for big files. - In Explorer / File Options / View Tab find and uncheck "automaticaly search for network folders and printers " Have you ever connected this PC to the LAN? There is a weird thing: when you do the above some associations for opening files can be changed for network names “\\” in the Registry and another interesting article comes to mind (but I cannot find it right now) programs' network rules could be set that they are accessing particular IP addresses and when PC is disconnected that is still happening until that times out. Therefore, there is a delay that could be around 30 seconds before the file opens normally. You may check if there are network activities when you are opening files with Notepad. Any logged events in the System/Application Event viewer at the moments when you are using Notepad? You can clean IDS Log and check what is logged there as well at that time. Not much help and no more ideas at this point. My regards
    2 points
×
×
  • Create New...