Pros & Cons
-
- Online console allows full remote management
- Prevented all file-encrypting ransomware behavior in testing
- Very good scores in our hands-on tests
- Dangerous website blocking is browser-independent
-
- Unusually lengthy initial scan
- Scores from just one independent lab
Emsisoft Anti-Malware Specs
| Behavior-Based Detection | |
| Malicious URL Blocking | |
| On-Access Malware Scan | |
| On-Demand Malware Scan | |
| Phishing Protection | |
| Protection Type | Antivirus |
| Ransomware Behavior Detection |
Emsisoft Anti-Malware touts itself as being “a complete defense system against malware, ransomware, phishing, and more.” One independent lab certifies its business edition, and it scored high in our hands-on tests and prevented all file-encrypting ransomware. It also includes full-featured remote management, enabling extensive control over security settings and network-wide scanning—capabilities that many other antivirus programs don’t match. If remote management is a priority, Emsisoft is a solid choice. If not, you should consider our Editors’ Choice winners, Bitdefender Antivirus Plus and Norton AntiVirus Plus. Both routinely achieve perfect or near-perfect scores on numerous lab tests, and both offer more security bonuses than Emsisoft.
How Much Does Emsisoft Anti-Malware Cost?
Just under $40 per year is the most common price for standalone antivirus protection. More than a quarter of the antivirus programs I follow fit that price range. ESET NOD32 Antivirus, Trend Micro Antivirus+ Security, and ZoneAlarm Pro Antivirus + Firewall are among them. Emsisoft, too, fits this profile at $39.95 per year for a single license. You can get three Emsisoft licenses for $59.95 or five for $79.95.
Another substantial group, including Avira Antivirus Pro, Bitdefender, and Malwarebytes Premium Security, costs between $45 and $50 per year. At $59.99 per year for a single license, you pay as much for Norton as you do for three Emsisoft licenses, though it includes spam filtering, password management, online backup, and other bonus features.
Getting Started With Emsisoft
As with many modern security utilities, you begin your Emsisoft adventure by creating an online profile. From the profile, you can start a 30-day free trial or enter your license code. When you launch the Emsisoft installer, it downloads the latest version.
During installation, you get an interesting choice for security management: you can opt for fully local, fully remote, or a combination of the two. All-remote management is typically a business style, but you might choose it for a relative who’s not good at leaving things alone. All local is, of course, the most secure because there’s no chance of some cyber ninja breaking into your management console. Most users will stick with the default, allowing both local and remote configuration.
(Credit: Emsisoft/PCMag)Presuming you include remote configuration, the installer guides you through creating an online workspace. Workspace names must be unique in Emsisoft's system for security reasons. The system warns if the name you’ve typed is already in use. Once the main window opens, you'll notice that the Protection panel displays a No Protection warning for a brief moment. Just give it a few seconds to finish installing, updating, and configuring its components.
Four big panels dominate the main window's light-colored background: Protection, Scan & Clean, Logs, and Settings. A left-rail menu effectively duplicates the effect of clicking the panels; the one you’ll use most is the Overview icon, which brings you back to the main screen. Emsisoft's combination of greens, blues, and whites gives it a pleasant appearance, quite different from the tough-looking slate-gray tones found in many competitors. Don’t worry; if you don’t like that look, you can choose dark mode.
(Credit: Emsisoft/PCMag)Scan Choices Abound
Right in the Scan & Clean panel, without ever leaving the Overview page, you can click links to run a quick scan, a malware scan, or a custom scan. Clicking the panel itself brings up a page with clear descriptions of each scan. The quick scan scans only active programs, looking for traces of malware. The malware scan looks in "all places that malware typically infects."
What about the familiar full scan of your entire computer, seen in most other antivirus utilities? To get that, you choose a custom scan. By default, it scans the entire C: drive, which is what you probably want. The custom scan page includes several settings to configure just how the scan proceeds, but they come preconfigured for the best protection. Don't change them unless you know what you're doing.
(Credit: Emsisoft/PCMag)A full custom scan of a standard clean test system took over three hours, while the current average is a bit less than two hours. A second scan finished in half the time, indicating that the initial scan performed some optimization steps, perhaps marking known safe programs so they needn’t be scanned again.
Other antivirus programs take optimization even further. Trend Micro, for example, went from 77 minutes to barely over a minute, and Vipre Antivirus Plus dropped from nearly 3 hours to 21 minutes on a repeat scan. To be fair, Emsisoft emphasizes the malware scan, which took three minutes, and the quick scan, which finished in less than 20 seconds.
(Credit: Emsisoft/PCMag)I recommend running a full scan immediately after installing a new antivirus to remove any malware that may have taken up residence before you installed antivirus protection. Emsisoft does schedule a weekly full scan, but it’s not active until you open the scheduler and enable it. You can also schedule other scans daily, weekly, or monthly.
(Credit: Emsisoft/PCMag)There's one more scan-related action you should consider. Clicking Emergency Kit Maker on the scan page lets you create your own self-contained Emsisoft Emergency Kit. This is a standalone executable you can save on a removable drive and use to scan other computers, perhaps ones so badly infested by malware that you can't install the full antivirus. This isn't a bootable rescue system like the one you get with Bitdefender, but it can still be a useful tool.
Few Scores From the Antivirus Testing Labs
Independent antivirus testing labs worldwide evaluate antivirus utilities and report on how well they perform their core tasks. I follow five such labs, and I'm impressed by any antivirus that appears in reports from all five. Only Avira, Microsoft Defender Antivirus, and Norton show up in the latest tests from all five labs. In years past, Emsisoft received good marks from AV-Test Institute and AV-Comparatives, but it’s been several years since those labs included Emsisoft.
Three-quarters of the tested programs received a perfect score in the most recent AV-Test report, and all but one of the remaining programs scored 17.5. A score of 17.5 or better earns the antivirus a Top Product rating. Over a quarter of the tested programs earned Advanced+ (the highest certification) across three AV-Comparatives tests, including Avast One Basic, AVG AntiVirus Free, and ESET.
Experts at SE Labs use a capture-and-replay system to subject multiple antivirus apps to the same malware attacks and rate success on a five-level scale: AAA, AA, A, B, and C. In this lab’s latest test, all the antivirus apps I follow reached AAA. Likewise, they all achieved at least Level 2 certification in tests by MRG-Effitas, and all scored 100% with AVLab Cybersecurity Foundation. Emsisoft's consumer edition, reviewed here, didn't participate with AVLab, but its business edition, using the same antivirus engine, scored 100%.
Each lab has a different rating system, which makes comparisons tough. I’ve devised an algorithm that normalizes all the scores to a scale from 0 to 10 and yields an aggregate lab score. With perfect scores from all five labs, Norton gets a perfect 10-point score. Avast is close, with 9.8 points based on five labs. ESET also holds an aggregate score of 9.8, derived from four sets of lab results.
Very Good Malware Protection Scores
When I get little help from the labs, my own hands-on malware protection testing becomes vitally important. To start the basic protection test, I simply open a folder containing a collection of malware that I've gathered, curated, and analyzed myself.
For many antiviruses, the minimal access required when Windows Explorer checks a file's name, size, and creation date for display is enough to trigger an on-access scan. For others, the trigger involves copying samples to a new location. And in a few cases, such as Guardio, nothing happens until I download the samples from an online source.
Then there are those like Avast, AVG, McAfee AntiVirus, and Emsisoft that wait until a process launches to check it for malware. That means a bit more work for me, as I must launch every single sample. Fortunately, Emsisoft caught almost 90% of the samples immediately at launch. Each such detection triggered a slide-in notification from the antivirus, along with a Windows error message stating that the file contained a virus. Most of the items that did manage an initial launch got caught as they continued to install and act.
(Credit: Emsisoft/PCMag)Emsisoft detected 98% of the samples, either immediately on launch or later in the process. Malwarebytes and Webroot achieved 99% detection, while McAfee and UltraAV scored 100%; the rest scored lower than Emsisoft.
Detecting malware is one thing; fully blocking its installation is another. An antivirus must prevent the installation of any executable files and allow no more than 20% of non-executable junk to get full credit. Here, Emsisoft fell a bit. In most cases where it didn’t wholly block malware execution, it allowed the installation of one or more malware-related executables. With 98% detection, its highest possible score would be 9.8 points, but its incomplete malware blocking knocked that down to 9.4.
Because gathering and analyzing a new selection of malware takes a long time, I can’t refresh the collection often. To see how each antivirus handles up-to-the-minute malware, I use a feed of recent malware-hosting URLs generously provided by MRG-Effitas.
Similar Products
Our Current Picks for The Best Antivirus Software for 2026
As I go down the list, launching each URL, I discard any that are already defunct. For those that are still viable, I note whether the antivirus blocks access to the URL, eliminates the malware payload, or simply fails to react. When I have 100 data points, I run the numbers.
(Credit: Emsisoft/PCMag)Emsisoft boasts two distinct defenses in this realm. The browser-independent Web Protection checks URLs against a local blocklist that’s updated every 15 minutes and prevents all access from any browser or other program, sliding in a notification so you’ll know what happened. The Browser Security extension (for Firefox, Chrome, Edge, and other Chromium-based browsers) checks unknown URLs against Emsisoft's online database and diverts dangerous access attempts to an explanatory page.
Based on prior experience, I dug into File Guard settings and changed the Scan Level from the default to Thorough. Among other things, this ensures that Emsisoft checks files on download rather than waiting for attempted execution.
(Credit: Emsisoft/PCMag)Emsisoft blocked 32% of the malware-hosting URLs and wiped out another 67% during the download process. Its total protection score of 99% beats the 93% it achieved in its last test. Norton and UltraAV also scored 99% in this test, while Avira, Guardio, and Sophos Home Premium managed 100% protection.
Much Improved Phishing Protection
The perpetrators of phishing websites don't need any malware coding skills. They don’t have to write Trojan malware that can steal login credentials. Rather, they rely on inattentive web surfers to simply hand over their passwords. Phishing sites mimic financial, shopping, and even dating sites, displaying realistic login pages. If you enter your username and password, the fraudster owns your account. These sites get taken down quickly, but the criminals just pop up another one. While you can learn to spot phishing fraud, not everyone has the knack, and all of us have a less-focused day from time to time. It’s good to have backup from your antivirus when you’re not quite as alert.
To test phishing protection, I start by gathering hundreds of reported fraudulent URLs, ensuring they include both verified frauds and those too new to have been analyzed. I launch each simultaneously in a browser protected by the antivirus under test and in instances of Chrome, Firefox, and Microsoft Edge, protected only by their built-in antiphishing filters. Only verified phishing sites that load properly in all four browsers count toward the totals.
The last time I ran this test, Emsisoft detected 89% of the verified phishing frauds, not a great score, but better than its 55% detection the time before that. In the current test, Emsisoft detected 97% of them, quite a decent score. Even so, seven competitors scored 100% in their own phishing protection tests, including Avira, Surfshark One, and Webroot.
Excellent Detection of Ransomware Behavior
Malware coders are always working on new attacks, new hiding techniques, and new ways to slip past antivirus protection. If they manage to slip through a Trojan or a botnet that your antivirus misses, that's not good, but an update will likely wipe out the problem within a few days. If the zero-day attack involves ransomware, though, you're in big trouble. Your files are already encrypted, and removing the ransomware won't restore them. That's why many antivirus tools now include an extra layer of protection against ransomware.
Emsisoft's ransomware protection isn't separate from its general-purpose Behavior Blocker. Fortunately for my testing, Emsisoft doesn't couple behavioral protection with the regular real-time protection of the File Guard component, as Trend Micro, Avira, and a few others do. I had no trouble turning off File Guard while leaving ransomware protection active. Turning off real-time protection simulates a zero-day ransomware attack that bypasses ordinary real-time protection.
(Credit: Emsisoft/PCMag)This tool's ransomware protection focuses on the widespread problem of file-encrypting ransomware. After cutting off my test virtual machine from the network, I launched a dozen real-world encrypting ransomware samples. Emsisoft detected and blocked all but one of them, identifying them as suspicious based on behavior and completely preventing any harm to files on the test system. As for the one not caught, it didn’t do anything, so naturally it wasn’t caught.
My collection also includes two of the less common disk-encrypting ransomware. Given its focus on file-encrypting ransomware, I wasn’t surprised that Emsisoft’s behavioral system didn’t detect these. Do remember that with File Guard active, Emsisoft eliminated every ransomware sample before any could execute.
As a further test, I configured a few ransomware samples to launch at startup and rebooted the test system. Some ransomware detection systems are slow out of the gate, allowing ransomware attacks before they’ve fully fired up their protection. Not Emsisoft. It visibly got ahead of the threats, wiping them out just as it did when I launched them directly.
Emsisoft’s behavioral detection proved supremely effective against ransomware, suggesting that if a brand-new ransomware attack gets past File Guard (which was turned off during my test), Emsisoft will still detect it and protect your important files. And where many behavior-based ransomware detection systems don’t kick in until after the ransomware has encrypted numerous files, Emsisoft protected every single file.
Remote Control Management Console
Emsisoft's Management Console offers thorough remote management. This feature is especially useful for businesses installing Emsisoft protection across multiple systems, but it's also available to home users.
(Credit: Emsisoft/PCMag)Remember that workspace you created back at install time? That’s where you go to engage in remote management. To start, you log into the My Emsisoft online portal, the same place you registered your license. Note that each login requires entry of a security code sent to the email address associated with your account, providing a modicum of multi-factor authentication. Once you’ve logged in, you have full access to your workspace.
A few other antivirus programs offer some degree of remote access. Webroot Essentials used to let you view and control quite a bit, though that feature is much diminished at present. Sophos gives you full remote control. With Emsisoft, too, you control the application’s full range of settings. If you can do it locally, you can do it remotely. You can even access the local user interface remotely, so everything you learned about that interface carries over. Launch a scan? View files in quarantine? Change settings? No problem!
(Credit: Emsisoft/PCMag)For some home users, this complete remote management can be a big selling point. Now you can install antivirus software for your relatives and address their security concerns without driving across town. You can even lock local access to settings, disable confusing notifications, or hide such things as the purchase and renewal buttons.
Inquisitive users will notice there are quite a few other choices in the console’s left-rail menu. Some are clearly too complex for the consumer, like Threat hunting. Do you know how to run OSQuery-based data queries? Neither do I. I also don’t know what Playbooks refers to, and I won’t easily find out, since it’s locked and available only in a “higher license plan.”
Other than the informative Incidents list, the most worthwhile workspace feature is Protection policies. If you’re installing Emsisoft on multiple computers, you can save time by formalizing your preferred configuration settings as a protection policy. Now each new installation will automatically use your configuration preferences.
Content Filtering Controlled Remotely
Sharp-eyed users may notice a grayed-out switch labeled Content filtering in the main window. If you try to turn it on, you get a tooltip warning that says, “Please contact your protection administrator to change this setting.” But in fact, you are the protection administrator. It’s just that you must configure this feature through the online dashboard.
(Credit: Emsisoft/PCMag)Log in to your Emsisoft account online, select your workspace, and click Protection policies in the menu on the left. Unless you’ve changed the defaults, you’ll find you have just one, titled New computers. Select the policy and scroll down in the main part of the window until you see Content filtering.
Emsisoft lets you filter sites with unwanted programs, porn, gambling, social media, or scams. By default, they’re all set to Don’t block. You can change that to Block with information or Block silently. If you choose the latter, attempting to visit a site that matches the filter just gets you a browser error. The option to block with information replaces the blocked page with a warning and a slide-in notification that lets you cancel blocking.
(Credit: Emsisoft/PCMag)Clearly, this is not a parental control system. It’s more suited to a business environment. If your employee accidentally tries to visit a porn site, Emsisoft heads off any HR problems by ensuring that the site doesn’t get displayed.