SuperAntispyware 6 Released

[ICIT2LOL]

I still consider Malwarebytes better (and testing seems to bear that out). But it is apples and oranges, each has it's strengths. I have both as active protection, and even with both free, it costs nothing to have two. I also have Emsisoft free which I run in my weekly scans before creating images. I see few mention it, but I consider it also well worth having

Emsisoft Anti-Malware for best protection - Free removal of Viruses, Bots, Spyware, Keyloggers, Trojans and Rootkits

It gives you 30 days full protection if you want it, then reverts to an on demand scanner. I just choose to decline the 30 day full, and install it as free from the beginning.

A Guy

Yes mate I saw that today in the AV Comparatives report and if I wasn't Kaspersky set I would try it as my doc has raved about it for years.
I like the Emsisoft Emergency Kit too for a on call scan too - very good and has found heaps of stuff even the KISS and MBAM and SAS have missed. Emsisoft Free Emergency Kit: portable malware scanner | Free removal of Viruses,Bots, Spyware, Keyloggers and Trojans you only really need run the Emergency Kit and Command Line scans

 

[carwiz]

Emisoft gets my vote and I'm sold on it. I just tried out the Emergency Kit. Other than dropping a shortcut on my desktop when I installed the package to a removable drive, it found three items that MBAM and MSE didn't.

After seeing a thread here the other day about YouTube downloads (Yes, I know the subject is restricted) , I watched a YouTube video about a person claiming that software is not needed. I should have known better but my curiosity got the better of me and clicked on the links provided. They didn't work and I dismissed it. Well, turns out the site attempted to load software and messed with Registry settings. I'm sure MSE blocked the actual running of software but the registry tampering must have slipped through.

Here's what the site did. Note that it disabled Task Manager and Registry Editor. So lesson learned.

 

[carwiz]

What? Everybody out running scans now?

 

[andrew129260]

Hitman pro and malwarebytes are great at detecting those reg changes as well. So is panda and avast.

My problem is I have local group policy enabled for my lady, (with those restrictions in place) so it warns me all the time and I have to keep ignoring it.

 

[A Guy]

Emisoft gets my vote and I'm sold on it. I just tried out the Emergency Kit. Other than dropping a shortcut on my desktop when I installed the package to a removable drive, it found three items that MBAM and MSE didn't.

After seeing a thread here the other day about YouTube downloads (Yes, I know the subject is restricted) , I watched a YouTube video about a person claiming that software is not needed. I should have known better but my curiosity got the better of me and clicked on the links provided. They didn't work and I dismissed it. Well, turns out the site attempted to load software and messed with Registry settings. I'm sure MSE blocked the actual running of software but the registry tampering must have slipped through.

Here's what the site did. Note that it disabled Task Manager and Registry Editor. So lesson learned.

Those are Group Policy settings, they can also be from running Junkware Removal Tool(JRT). I have them as well, and Emsisoft is the only program to list them. They are simply settings that could be abused by malicious malware. They are set to disabled (otherwise your Task Manager and Regedit would have been disabled). They do not exist on Windows by default, but I know mine came from JRT. It would not hurt to quarantine or delete them.

A Guy

 

[andrew129260]

Emisoft gets my vote and I'm sold on it. I just tried out the Emergency Kit. Other than dropping a shortcut on my desktop when I installed the package to a removable drive, it found three items that MBAM and MSE didn't.

After seeing a thread here the other day about YouTube downloads (Yes, I know the subject is restricted) , I watched a YouTube video about a person claiming that software is not needed. I should have known better but my curiosity got the better of me and clicked on the links provided. They didn't work and I dismissed it. Well, turns out the site attempted to load software and messed with Registry settings. I'm sure MSE blocked the actual running of software but the registry tampering must have slipped through.

Here's what the site did. Note that it disabled Task Manager and Registry Editor. So lesson learned.

Those are Group Policy settings, they can also be from running Junkware Removal Tool(JRT). I have them as well, and Emsisoft is the only program to list them. They are simply settings that could be abused by malicious malware. They are set to disabled (otherwise your Task Manager and Regedit would have been disabled). They do not exist on Windows by default, but I know mine came from JRT. It would not hurt to quarantine or delete them.

A Guy

You said it better

 

[ThrashZone]

Well it looks as though the update finally hit,
Updated well without any quirks or need for sas clean more than what I can say about mbam 2.0

 

[andrew129260]

Well it looks as though the update finally hit,
Updated well without any quirks or need for sas clean more than what I can say about mbam 2.0

You don't let things go easily do you?

 

[ThrashZone]

Yea I believe we might have that in common Andrew :roflmao:

 

[A Guy]

It did an update to mine today as well. Guess this is when they feel it's safe for everyone. A Guy

 

[andrew129260]

It did an update to mine today as well. Guess this is when they feel it's safe for everyone. A Guy

Yeah. They released 2 minor program revisions before it was sent out to customers. They were kinda like mini betas.

 

[SASDave]

Hi, I just wanted to give a quick heads-up on the drivers/services that SAS uses/installs...

SAS Core Service - this is a slave process that SAS uses to perform actions for which the current user does not have permission (i.e. Limited User or Admin User with UAC enabled).
SASKUTIL - this will give SAS some additional permissions that the core service is unable to enable (like rootkit detection).
SASDIFSVC - this will delete files that were detected as threats when the computer is restarting. It happens very early in the boot process, before something can re-create itself.

The two drivers do nothing while the computer is running, the core service does nothing unless SAS is running... they're just installed to be used when needed.

Also, the data System Investigator sends to our whitelist server is an MD5 hash of the file data, the filename and your vote selection if you've voted. The results contain only executable program files (no documents, images, etc) and we tokenize the folders to remove the user's name from the path if needed (i.e. C:\Users\Dave\Program.exe turns into %UserProfile%\Program.exe). This data is completely anonymous, your privacy is very important to us. This minimum amount of information is needed for us to research items to whitelist.

 

[A Guy]

Welcome to Seven Forums Dave. Thanks for contributing to this thread. It's good to have someone from the company here. A Guy

 

[SASDave]

Welcome to Seven Forums Dave. Thanks for contributing to this thread. It's good to have someone from the company here. A Guy

Thanks for the welcome; I'm not too active on forums, but I'll chime in if I spot a question that I can answer.

Found this thread while searching google for feedback on the new System Investigator tool. This feature was my idea and design so I'm interested to hear how it's doing out in the wild.

 

[andrew129260]

Welcome to Seven Forums Dave. Thanks for contributing to this thread. It's good to have someone from the company here. A Guy

Thanks for the welcome; I'm not too active on forums, but I'll chime in if I spot a question that I can answer.

Found this thread while searching google for feedback on the new System Investigator tool. This feature was my idea and design so I'm interested to hear how it's doing out in the wild.

Well in that case, coming from someone who removes malware a lot, I really value this new tool.

So thank you! The information it gives is very nice and categorized well.

 

[Layback Bear]

Welcome SASDave to our forum.

 

[ICIT2LOL]

Emisoft gets my vote and I'm sold on it. I just tried out the Emergency Kit. Other than dropping a shortcut on my desktop when I installed the package to a removable drive, it found three items that MBAM and MSE didn't.

After seeing a thread here the other day about YouTube downloads (Yes, I know the subject is restricted) , I watched a YouTube video about a person claiming that software is not needed. I should have known better but my curiosity got the better of me and clicked on the links provided. They didn't work and I dismissed it. Well, turns out the site attempted to load software and messed with Registry settings. I'm sure MSE blocked the actual running of software but the registry tampering must have slipped through.

Here's what the site did. Note that it disabled Task Manager and Registry Editor. So lesson learned.

Yep mate I have been using it for some time now after our late Gary put me onto it ADW and SAS .
I only usually use the Emergency and Command line scans with Emsisoft as they pick up the majority of the rubbish and to be honest MBAM hardly picks up a thing - mind you I am running it real time with Kaspersky.

As a by the by my own doctor who I have had a working relationship in the past swears by the Emsisoft paid for software.

But for on call scanners I still reckon this is the best listing around.
Probably the Best Free Security List in the World - Part I They have changed the particular link to this but it covers just about everything. They also have other security stuff ie for rookits and some in depth scanning programs too that I have used on occasion etc etc. It is one of my main bookmarks when I am scratching around re malware stuff and a mile of really useful links.

 

[ThrashZone]

Hi, I just wanted to give a quick heads-up on the drivers/services that SAS uses/installs...

SAS Core Service - this is a slave process that SAS uses to perform actions for which the current user does not have permission (i.e. Limited User or Admin User with UAC enabled).
SASKUTIL - this will give SAS some additional permissions that the core service is unable to enable (like rootkit detection).
SASDIFSVC - this will delete files that were detected as threats when the computer is restarting. It happens very early in the boot process, before something can re-create itself.

The two drivers do nothing while the computer is running, the core service does nothing unless SAS is running... they're just installed to be used when needed.

Also, the data System Investigator sends to our whitelist server is an MD5 hash of the file data, the filename and your vote selection if you've voted. The results contain only executable program files (no documents, images, etc) and we tokenize the folders to remove the user's name from the path if needed (i.e. C:\Users\Dave\Program.exe turns into %UserProfile%\Program.exe). This data is completely anonymous, your privacy is very important to us. This minimum amount of information is needed for us to research items to whitelist.

Welcome to SevenForums SASDave,
Love the product here's an avatar if you want to use it
View attachment 329488

 

[ICIT2LOL]

Sorry Dave please forgive the manners but welcome and I do like the new GUI and it seems to be so much faster than it was before.
John

 

[Stephanie]

Mines working fine