Overview:
Sometimes, applications as games, small customized apps or even business software are erroneously flagged as dangerous, even though they are safe to use. This may happen when an application is not digitally signed.
In a perfect world, all legitimate software would be digitally signed. Code signing is the process of digitally signing executables and scripts to confirm the software author and to guarantee that the code has not been altered or corrupted from the moment of his publication.
Malware is known for not being digitally signed. For this reason, unsigned apps will be flagged by your Anti-Malware as a precaution, giving you the choice to allow them into your system or block them.

How do deal with quarantined program:
If a program is flagged as dangerous and you are not sure if it is safe to use or not, it is best to leave it in the Quarantine.
Emsisoft gives you the possibility to share the info of this software to our lab for analysis directly, comfortably from the Quarantine panel. Here’s how:

1. Open the local Emsisoft app on the computer.
2. Click on: Quarantine in the blue tab: Scan & Clean
3. Highlight the file
4. Then click on: False Detection. Please include your accurate email address so we can reply. Please make sure to also fill out the info about the alert and the program.
5. Then please click the: Send button

Once our lab receives the files information, we can analyze how safe that software is.
If it is safe, we will then whitelist it if it is legitimate and allow it through the anti-malware. Will reply to you, so that you can then restore the file by clicking on the file in the Quarantine and by clicking: Restore.

You can also submit the file causing the detection via email to our lab: fp@emsisoft.com so we can analyze and correct the suspected false detection.
If the file is too large to send, please upload it to Virustotal and send us the web address of the scan result via email to submit@emsisoft.com or send us the file via wetransfer.com to submit@emsisoft.com

Files that were tested by us and are not digitally signed need to be added to Monitoring Exclusions, otherwise it will be flagged again each time it is updated without the necessary certificate.
If you are CERTAIN that the program is OK, you can add it directly to the Monitoring Exclusions.

The post False positives: Why did Emsisoft quarantine a safe program? appeared first on Emsisoft Help.

At Emsisoft, we understand how frustrating technical problems can be. This is the reason you always have a real person to chat with you, and your email messages are addressed within a couple of hours, if not instantly.
Our dedicated support team is here to provide swift and effective solutions to all your concerns, whether they are technical, billing, or administrative in nature. With their expertise and your cooperation, you can expect a speedy and efficient resolution to any issue.

While nearly all reported issues can be resolved through our self-help pages, this blog article outlines the steps you can take to expedite the resolution process when reaching out to our Support Team.

Channels

You can contact us through our Help Pages, where you can use the Mail or Chat button, both options are accessible from the bottom left corner of the interface of our installed software, as well.
Alternatively, you can send us an email to support@emsisoft.com or initiate a chat by clicking on the chat bubble in the corner of any of our webpages.
For more complex issues, we encourage you to use email, which allows for detailed descriptions of steps taken, screenshots, and logs.
For quick questions, the chat channel is your best option, but please keep in mind that we need to verify your identity, which can be done by providing us the relevant order number or license key.

Regardless of the channel, please explicitly state that we have permission to access your workspace. Granting us access to view your workspace information is essential in replicating and resolving issues.

Here’s a summary of the crucial details you should include in your communications with us:

Provide a Clear and Detailed Description

When creating a support ticket, your description of the issue is vital. Emsisoft’s dedicated support team relies on specificity. Please include:

• The nature of the problem or request.
• When the issue first occurred.
• Any error messages or codes encountered.
• Recent changes to your system or software.

Clear and concise descriptions help our team to quickly understand the problem, avoiding unnecessary delays due to vague descriptions.

Include Relevant System Information

Emsisoft’s experts need information about your hardware, software, and environment for effective diagnosis and resolution. Please provide:

• Name of your workspace and computer.
• Permission to log into your Workspace to check Settings and Logs
• Device type (e.g., laptop, desktop, smartphone) and Operating System version.
• Recent updates or changes made to your system.

This information helps Emsisoft’s support agents narrow down potential causes and provide solutions specific to your setup.

Attach Relevant Screenshots or Logs

Visual aids, logs and description of recent events can be very helpful in diagnosing issues, for instance:

• If your issue involves error messages, software glitches, or any visual anomalies, please take screenshots and attach them to your support ticket.
• More rarely we will ask you to collect logs locally, on your device. Here you can find the step-by-step instructions on how to collect debug logs and FRST Logs.

Mention Any Troubleshooting Steps Taken

If you’ve already attempted to address the issue on your own, Emsisoft’s support team encourages you to share what you’ve tried. For this reason, please include details about any troubleshooting steps, fixes, or workarounds you’ve attempted.

Conclusion

Our dedication to your satisfaction, together with your cooperation in providing punctual information, guarantees that your technical issues are addressed promptly, effectively, and effortlessly. Our excellent Support Team is always available to help you, rest assured that you are in good hands.
Please do not hesitate to visit our help pages and reach out to us whenever you need.

The post How to resolve your technical issues quickly appeared first on Emsisoft Help.

You can download FRST from one of the following links (the files will be downloaded from BleepingComputer.com), and then follow the instructions below to run it. After clicking the download link, do not click anything on the web page that appears. Wait for the download to start, usually less than 10 seconds. Save the file before running it instead of immediately clicking run.

• FRST for 32-bit Windows
• FRST64 for 64-bit Windows

1. If you’re not certain which version of FRST to download, then download both of them.
2. Since most web browsers save all downloads in your Downloads folder, we recommend copying it to your Desktop before proceeding. Please do not click ‘Run’ in your web browser since this may cause trouble for you later in the support process. Instead, click ‘Save’ or ‘Save as’ if presented with the option.
3. With FRST saved to or moved to your Desktop, right-click on the icon and choose run as administrator. If both versions of FRST were downloaded, note that only one of them will work on your computer. Try each of them, starting with FRST64, as it is the most common. It will tell you if it cannot run on your computer, at which time try the other one. Otherwise, continue. A few notes:
   • FRST is safe if downloaded from the links given above. Some programs, even ours, may see FRST as potentially bad due to its nature, but please allow it to run regardless of warnings. In Emsisoft Anti-Malware, if it alerts, click “Wait, I think this is safe”.
   • On Windows 10, when you run FRST you may see a SmartScreen notice that Windows has protected your computer. If you do, then please click More info and select to allow FRST.
4. When you run the correct version of FRST for the first time, it will show you a disclaimer. You will need to click Yes to continue. The program’s main interface will appear, looking like the following image. Leave all options exactly as they are seen here unless specifically requested by the support representative:
5. Once the disclaimer closes, click on the Scan button on the left to start the scan. The scan may take a while, typically being 1-5 minutes. If it appears the computer is locked up, please wait. Note the green progress bar and changing text above the Search box that shows progress. If the program locks up for more than 40 minutes, please let us know what it says above the Search box, and close the program if possible. If Emsisoft Anti-Malware alerts when FRST is run, it will probably alert again during the scan. Please remain at the computer so that alert can also be responded to with “Wait, I think this is safe”.
6. When the scan is done, it will show dialogs telling you that it saved files named FRST.txt and Addition.txt, and will open Notepad showing you the contents of these files. Please wait until both of these dialogs have appeared and you have pressed OK to close them before continuing. Here is an example:
7. Close both of the Notepad windows that open, without saving, since both files are already saved at this point, then close the FRST program using the X in the upper-right corner.
8. There will be two log files on your Desktop (or wherever you ran FRST from). On most computers those log files will look similar to the following:
   Please send a reply to the support representative who asked you to run FRST, and attach the FRST and Addition log files to your reply.

If you were in contact with our support team via e-mail, but are not used to attaching files to e-mails, then just look for a button or link in the toolbar above where you write your message that has a paperclip icon, and clicking that should allow you to attach files to your e-mail.

The post How do I run a scan with FRST? appeared first on Emsisoft Help.

1. Download and run/open TeamViewer QuickSupport  version 15 from this link.
2. When TeamViewer opens, it will give you an ID and Password.
3. Leave TeamViewer running, and send the ID and Password to the support representative who asked you to run TeamViewer.
4. Wait for the support representative to connect.

If you have any questions regarding TeamViewer, or other remote access software we may use, then please feel free to ask one of our support representatives.

The post Remote Support: How do I use TeamViewer? appeared first on Emsisoft Help.

A computer resource problem prevents Emsisoft Anti-Malware from loading essential protection components.

There can be a number of different causes for issues with the EPP driver, however in many cases simply deleting the driver’s service is enough to solve the error message. The easiest way to do this is by using the Command Prompt to run a simple command to unregister the driver. Below are some instructions on how to do that on different versions of Windows. If you need more information, then please see the Frequently Asked Questions at the bottom of the article, or contact our support department.

After following the instructions below, the EPP driver should be re-registered with Windows, and the problem should be resolved. If it is not, then please submit a support ticket on our online helpdesk, and one of our support personnel will assist you.

Windows 7

1. Click on the Start button.
2. Go to All Programs.
3. Go to Accessories.
4. Right-click on Command Prompt and select Run as administrator.
5. Type in sc delete epp and then press Enter on your keyboard.
6. Restart the computer.

Windows 8

1. Right-click on the Start button.
2. Select Command Prompt (Admin) from the menu.
3. Type in sc delete epp and then press Enter on your keyboard.
4. To restart the computer, type shutdown /r /t 0 into the Command Prompt and then press Enter again.*

* This step is very important, as restarting Windows 8 normally may not cause the EPP driver to be re-registered properly when the computer restarts.

Windows 8.1

1. Right-click on the Start button.
2. Select Command Prompt (Admin) from the menu.
3. Type in sc delete epp and then press Enter on your keyboard.
4. Restart the computer by right-clicking on the Start button, going to Shut down or sign out, and selecting Restart.*

* This step is very important, as restarting Windows 8.1 normally may not cause the EPP driver to be re-registered properly when the computer restarts.

Windows 10

1. Right-click on the Start button.
2. Select PowerShell (Admin) from the menu.
3. Type in cmd and then press Enter on your keyboard to switch to the Command Prompt.
4. Type in sc delete epp and then press Enter on your keyboard.
5. Restart the computer by right-clicking on the Start button, going to Shut down or sign out, and selecting Restart.*

* This step is very important, as restarting Windows 10 normally may not cause the EPP driver to be re-registered properly when the computer restarts.

Also note that while you can run the “sc delete epp” command in PowerShell, it will not return the status of the command, so you won’t know if the driver existed or if it was deleted successfully, which is why we recommending switching to the Command Prompt from PowerShell before running “sc delete epp”.

Frequently Asked Questions

1. If this does not fix the problem, then what should I do?

It may be necessary to run the following commands in addition to sc delete epp if an old version of Emsisoft Emergency Kit had been used on the computer in question:

• sc delete epp32
• sc delete epp64

If nothing documented here works, then simply click here to go to our support contact form, submit a new support ticket, and our support team will assist you. You may also contact our support team via our official support forums if you prefer.

2. What if I need someone to do this for me?

Our support team has the capability of remotely connecting to your computer if needed. If you can’t perform these steps yourself, or if you don’t want to, then please click here to go to our support contact form, submit a new support ticket, and our support team will contact you to set up a time for a remote session.

Please note that remote sessions can take some time, and we may not always be able to schedule them right away. If you believe you will be able to perform the steps in the above instructions on your own, then we recommend going ahead and trying it so that the issue can be resolved as quickly as possible.

3. Isn’t deleting a driver a bad thing?

Normally deleting a driver is bad, however in this case you are not deleting any files. You are simply deleting the service that loads the driver.

4. What happens after running “sc delete epp” and restarting the computer?

When the computer restarts, our main service (a2service.exe, or the “Emsisoft Protection Service”) will start like normal, and if it detects that the EPP driver is not registered then it will simply re-register it. This recreates the service that loads the EPP driver, and thus it should fix the problem and the error message should be gone.

5. Why do newer versions of Windows need to be restarted in special ways?

When newer versions of Windows shut down or restart, they don’t stop all running services. After logging the user out and partially shutting down, they save an image of running services that are in memory (similar to the way “Hibernate” works), and then when the computer starts back up they restore that image and then resume in order to speed up the startup process. This means that, when the computer starts up, to many of the services on the computer it is as if the computer was never actually shut down. This has the unfortunate effect of preventing the Emsisoft Protection Service (a2service.exe) from re-registering the EPP driver, since a2service.exe never stopped running (at least from its perspective) and thus it never went through it’s normal start process.

The post Why am I receiving an error message about a Computer Resource Problem? appeared first on Emsisoft Help.

Please download and install Fiddler from this link, then follow the instructions below:

1. After installing Fiddler, if it doesn’t run automatically, click the Windows start menu button, then find and click the Fiddler icon. It is also possible to use the search box to type ‘Fiddler’ and run it from there.
2. In Fiddler, click the ‘tools’ pull-down menu, then ‘options’. Select the ‘HTTPS’ tab, and check the boxes “Capture HTTPS CONNECTs”, and “Decrypt HTTPS traffic”. Click OK to close the options window, then close and restart Fiddler.
3. Confirm that Fiddler is capturing traffic, and leave the program open. If it is not capturing, click its ‘File’ pull down menu and select ‘Capture traffic’. A check mark will appear to the left of ‘Capture traffic’ when it is.
4. Open Emsisoft Anti-Malware. If you’re not sure how, instructions can be found here.
5. Click the ‘Settings’ tile, then click the ‘Advanced’ tab. Scroll down if needed, and click the ‘Edit’ button for ‘Proxy settings’, then check the box that says ‘Use proxy’.
6. Leave the Proxy server type as ‘HTTP’. Enter “localhost” or “127.0.0.1” in the ‘Server’ field, and “8888” in the ‘Port’ field. Click ‘OK’ to close the Proxy Settings window. Return to the Emsisoft Anti-Malware main screen.
7. For update issues: Click ‘Update now’ in the lower right corner of Emsisoft Anti-Malware, and wait for it to fail or complete successfully, then skip the next step and proceed to step 9.
8. For license activation issues: Click ‘Details’ in the lower right corner of Emsisoft Anti-Malware, then ‘Change license’ if present. If it is not present, your Emsisoft Anti-Malware installation is likely managed, and you should stop here to contact the managers of your Emsisoft Anti-Malware installation. If it is present, either provide your MyEmsisoft credentials and click ‘Log in’, or click ‘Enter key’ in the bottom corner to enter your license key. Click ‘Next’, follow the steps provided, and wait for it to either fail or succeed. Proceed to step 9.
9. After the selected process completes, go back to Fiddler, then click the ‘File’ pull down menu, then ‘Save’. Select ‘All Sessions’, and save the created log file to a convenient location you can find later, such as your Desktop or Documents folder.
10. Right-click the saved log file and choose ‘Send to’, then ‘Compressed (zipped) folder’. Attach the zipped folder to a reply for us to review.

The post How do I create Fiddler logs? appeared first on Emsisoft Help.

• Download ProcDump from the Microsoft website.
• Once you have downloaded the Procdump.zip file, right click on it and choose 'Extract all…', and save it to a directory of your choice. A recommended location might be a ProcDump folder on your Desktop, such as C:\Users\User Name\Desktop\ProcDump where "User Name" is your own user name.
• Open a console Window. To do this, type 'cmd' into the Windows search box (Cortana on Windows 10) and wait for 'Command prompt' to appear. Right-click on it and choose 'Run as administrator'. Say yes to the UAC prompt that may appear.
• Change directory (cd) to the location ProcDump.zip was extracted to by executing (typing the command and pressing Enter) the following command, making sure to put a space between the command (cd) and the argument (ProcDump_path):
  cd "<ProcDump_path>"
  For example, the command to type might be:
  cd "C:\Users\User Name\Desktop\ProcDump"
  This assumes you may have created a ProcDump folder on your desktop, and put the Procdump program in it. The quotes are important if there are any spaces in the path. This is true for many commands, not just cd.
• Create the process dump by executing the following command, or the one provided by a helper:
  ProcDump.exe -ma <process name or PID (Process ID)>
  A few examples:
  ProcDump.exe -ma a2service.exe
ProcDump.exe -ma 512

The crash dump will be saved in the ProcDump directory and will be named based on the process name and the current time/date.

The post How do I create a manual full application crash dump? appeared first on Emsisoft Help.

• Download this from Microsoft and enable Memory dump settings.
• Reboot the system so your configuration changes become active.

If you encounter a blue screen you can now find the written memory dump either in the Minidump sub-directory of your Windows directory in case you enabled small dumps or in the file “memory.dmp” in your Windows directory for all other dump types.

You can change the dump file path by edit the Dump file field. In other words, you can change the path from %SystemRoot%\Memory.dmp to point to a local drive that has enough disk space, such as E:\Memory.dmp.

The post How do I configure automatic memory dumps in case of blue screens? appeared first on Emsisoft Help.

Download Crash Dump registry scripts for Windows 10

• Download the above file to your system and unpack it to a location of your choice.
• The names of the registry files are pretty self explanatory:
• “enable_mini_crash_dumps.reg” will enable mini crash dumps for all application crashes and is the setting we recommend during testing.
• “enable_full_crash_dumps.reg” will enable full crash dumps for all application crashes and should only be used after a developer requests a full crash dump.
• “disable_all_crash_dumps.reg” will disable all crash dump generation and is the Windows default behavior.

The settings become active immediately, no reboot is required. The crash dumps will be stored inside the “CrashDumps” sub-directory of your public profile (usually C:\Users\Public\CrashDumps).

The post How do I configure automatic crash dumps in case of application failures? appeared first on Emsisoft Help.

• Download this from Microsoft and enable Memory dump settings.
• Reboot the system so the changes to your configuration become active.

If the feature is enabled you can cause Windows to blue screen and write a memory dump by tapping the Scroll Lock key twice while holding down the right CTRL key.

The post How do I cause a controlled blue screen? appeared first on Emsisoft Help.