Emsisoft Anti-Malware

Main Window

The pastel-colored panels of Emsisoft Anti-Malware’s main window contain live links to much-used settings and actions. You can click on a panel (or on the corresponding button in the menu at left) to dig deeper.

Emergency Kit

At any time, you can launch a quick scan of active programs, a malware scan that checks commonly infested locations, or a custom scan of the whole disk. You can also create a portable Emergency Kit that you can copy to a removable drive and use to clean up other computers.

Scanning System

By default, the Custom Scan examines all of drive C:, making it equivalent to what other products call a Full Scan. You can customize just what the scanner looks for, but unless you’re an antivirus whiz, you shouldn’t.

Caught Malware

When Emsisoft catches malware trying to launch, it triggers a warning from Windows. A transient notification slides in from screen edge with additional information.

Known Malicious Host

Emsisoft works below the browser level, blocking access to known malware-hosting sites. The browser just shows an error message, with a transient notification from Emsisoft explaining what happened.

File Contained a Virus

Emsisoft hooks into a Windows service to provide antivirus scanning on download for several popular browsers. Here it has warned Edge of a dangerous download.

New Browser Extension

New since our last review, a browser extension for Chrome, Edge, and Firefox detects and blocks phishing frauds. It raised Emsisoft’s antiphishing score from dismal to middling.

Behavior Blocker

The Behavior Blocker component detects malware missed by the main real-time protection system. In testing with real-time protection turned off, it blocked every file-encrypting ransomware sample except for one that didn’t do anything.

Cloud Console

The Cloud Console lets IT teams manage Emsisoft for a whole business, but tech-savvy consumers can also use it by setting up a workspace and associating their Emsisoft installations with it.

Remote Management

When you select a protected computer within the Cloud Console, you get a replica of the local program, which makes every facet of the program available remotely.

About Our Expert

Neil J. Rubenking

Principal Writer, Security

My Experience

When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.

Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my "User to User" and "Ask Neil" columns, which began in 1990 and ran for almost 20 years. Along the way, I wrote more than 40 utility articles, as well as Delphi Programming for Dummies and six other books covering DOS, Windows, and programming. I also reviewed thousands of products of all kinds, ranging from early Sierra Online adventure games to AOL’s precursor Q-Link.

In the early 2000s, I turned my focus to security and the growing antivirus industry. After years of working with antivirus, I’m known throughout the security industry as an expert on evaluating antivirus tools. I serve as an advisory board member for the Anti-Malware Testing Standards Organization (AMTSO), an international nonprofit group dedicated to coordinating and improving testing of anti-malware solutions.

The Technology I Use

Much of the testing I do, particularly testing with real-world ransomware, is just plain dangerous. To perform such tests safely, I sequester them inside virtual machines managed by VMWare Workstation. For cross-platform testing, I use a MacBook Air, a Google Pixel 4, and a 6th-generation iPad.

I rely on my Delphi coding skills to create and maintain small applications. These include programs to check whether an antivirus correctly handled the malware it detected, launch dangerous URLs and record the security program’s reaction, and analyze the malware that I collect for use in testing. I also wrote a tiny browser and text editor for use in testing security apps that have predefined reactions for known products.

I do my writing and research on a Dell OptiPlex desktop, relying on Microsoft Word (my fingers know all the shortcuts). Many of my articles include charts and analysis; Excel is my go-to for those. When work hours end, though, I escape the bounds of Microsoft and Windows. There’s an iPhone in my pocket, I relax with my oversized iPad, and my Kindle Oasis is always loaded with the best science fiction and fantasy.

Read the latest from Neil J. Rubenking

Read full bio