Free antivirus that scans locally, with no account and no time limit.
What the free version includes, exactly
The list is not cherry-picked. Every item here can be verified in the product, in the documentation, or in a scan report.
All 17 local engines: hash, YARA, YARA-X, the MalNOX signature engine, PE structure, strings, heuristics, archives, scripts, VBA macros, DLP, web indicators, PUA, reputation, network, static emulation and the process memory scanner.
On-demand scanning of files and folders, with an optional deep mode for macro analysis and the more expensive rules.
AES-256-GCM encrypted quarantine: the file is moved, encrypted with a random 12-byte IV and a 16-byte tag, then deleted from its original location. Restore verifies the tag before writing anything.
The 67 YARA rules bundled in the package, plus the ability to write your own rules.
A per-scan PDF report with a per-engine table: you see exactly which rule triggered the verdict.
No account, no card, no ads in the product. The installer is 177 MB and bundles its runtime.
What the free version does not do
A free antivirus that hides its limits lets you believe you are covered when you are not. These are the real differences from the paid build, not the brochure ones.
No real-time protection. Files are not monitored automatically — you start a scan when you want, on what you want.
Signature and rule updates are applied manually from signed packages. There is no check that runs by itself in the background.
Cloud reputation and the advisory AI analyst are off. The verdict comes from local history and the rules on disk.
One device, no SLA-backed support. Community support stays available.
What a scan actually looks like
Nothing below needs the internet. You can unplug the network cable and the result stays identical.
Pick a folder with executables, not the whole disk. A first full scan is slow and produces triage noise.
Leave deep off on the first run. The YARA needle prefilter discards impossible rules before evaluation, which makes a 32 MB scan take 3.1 s instead of 21.6 s.
Expand the rows: SHA-256, MD5, MIME and the per-engine table show exactly what matched.
A “suspicious” verdict does not require isolation. You check the rule, check the file signature and decide with information.
Windows Defender is already installed. Why would you want another scanner?
Fair question, honest answer: Defender is a solid baseline and we never ask you to disable it. A second scanner makes sense when you want a second rule set, a verdict you can read line by line, and a result that depends on no connection at all.
Malnox does not ask you to disable Defender. The two can run together; our scan is on-demand, not resident, on the free plan.
The verdict is explainable: every engine writes its own score, and the final score is computed with a published formula, not a hidden average.
Data goes nowhere in the detection path. Zero DNS lookups, zero file telemetry.
Frequently asked questions about the free version
It is free with no time limit. It asks for no account and no card. There is no “trial” that locks after 30 days — the Free plan stays Free, with the engines and quarantine included.
Windows 10 version 1809 or newer, Windows 11, or Windows Server 2019+. 4 GB RAM, 400 MB free space. The Node 22.5+ runtime is bundled, so you install nothing else.
No. All 17 engines run locally and the detection path contains no network request. You can verify it: disable the network interface and start a scan — the verdict stays the same. Cloud reputation, the only feature that goes out, is optional and off on the free plan.
You can scan any path you can reach, USB sticks included. Real-time protection, available only on the paid plan, watches Downloads, Desktop and Documents by default — for other locations you start an explicit scan.
If you choose quarantine, the file is moved, AES-256-GCM encrypted and deleted from its original location. Metadata stays in the local database: original path, hashes and detections. Restore verifies the authentication tag before writing anything, so a modified blob is refused, not “almost restored”.
The package ships 67 rules, with 1,324 lines of rules written by us. These are not millions of signatures and we do not pretend otherwise: they are targeted rules, tested against a corpus that includes legitimate files, so they do not catch signed installers.
Yes, and the first year is free for every new account. After that, Malnox Complete costs 3 EUR per year for one seat. There is no forced upgrade: the Free plan stays available.
Useful next steps
Try it on a file you already have.
The installer is 177 MB and asks for no account. Not convinced? Check a link above — the web engine is already running on this page.