The most important basic rule when handling alerts is: Keep calm! You have plenty of time to make a decision because the reported program or connection has been immediately interrupted and rendered inoperative as soon as the alert occurs.
Hovering the mouse over top of the alert will pause its timer, giving you more time to read what is shown. The small blue bar moving across the bottom of the alert indicates the timer as it counts down until the notification disappears. Notifications can also be seen later inside Emsisoft Anti-Malware by opening the program and clicking the ‘Logs’ tile.
Read the alert message carefully and check the source (file name and path) of the file in question. This is often a good indication as to whether this is a suspicious or benign application. Did you start the program yourself or was it started in the background? Does the program come from a trustworthy source? What information can be obtained about the file properties by toggling the View details icon on the alert? In the case of Web Protection alerts, were you expecting this program to access the internet or connect to the described host?
If you are still unsure after considering the above points, then exercise caution and choose to quarantine the file or block the connection. Then contact our support team and give them all readable information from the alert as well as the Emsisoft Anti-Malware version, Windows version and what you were doing when the alert appeared.
Behavior Alerts
Behavior alerts offer the following options:
- Allow once – If you are sure the behavior is valid, you may continue the action.
- Allow always – Allow this behavior now and in the future.
- Block once – End this program now, but do not move it to quarantine.
- Quarantine (recommended) – Stop the action immediately and prevent the program from being accessed again.
Malware and Potentially Unwanted Program Alerts
Malware and Potentially Unwanted Program alerts offer the following options:
- Allow once – If you think the File Guard detection is incorrect, you may continue the action.
- Allow always – Don’t alert to any signature detections for this file anymore.
- Block once – Block access to the file once, but do not move it to quarantine.
- Quarantine (recommended) – Stop the action immediately and prevent the file from being accessed again.
Web Protection Alerts
Web Protection alerts offer the following options:
- Allow once – If you are sure the host is safe, you may connect to it anyway.
- Allow always – Allow access to this host now and in the future.
- Block once – Block access to this host now.
- Block always – Block access to this host now and in the future