Why did an Emsisoft product detect an innocent file as malware?

This situation is not caused by an error of the software! It shows that the protection mechanisms of our software work correctly by detecting malware-like behavior in files that are not already known and classified.

If the Emsisoft program alerts about malicious behavior for a well known program, you can opt to permanently allow the program on your computer by clicking the “Wait, I think this is safe” link on the notification that appears. Sometimes, valid programs that aren’t already classified or electronically signed show similar behavior to malware. The Behavior Blocker will show an alert in those cases.

If you are sure that the file which was detected by one of the Emsisoft programs is not really malicious but it was not quarantined, it may be a false positive. Please report such detections, so we can correct them, here’s how:

• If you already moved the file to quarantine or the Emsisoft program automatically did, you can also use the “False detection” button below the list of quarantined items to send us a false positive report. Please include your accurate email address so we can reply.
• You can also submit the file causing the detection to [email protected] so we can analyze and correct the false detection.
• If the file is too large to send, upload it to Virustotal and send us the web address of the scan results instead.
• If you still have difficulties, please contact us by email at [email protected] or use the built-in support request tool inside the Emsisoft program and send the logs database in the process. Be sure to include the name of the file that was detected in the email or message box of the built-in support request tool.

In the meantime, you can whitelist the the file with an exclusions in your MyEmsisoft console, using the instructions available by clicking this link.
Note that Emsisoft Emergency Kit only has scanning exclusions, while Emsisoft Anti-Malware has scanning and monitoring exclusions. Monitoring detections are indicated by the word ‘behavior’ in the notification.