Always included
The first year is free on any paid plan. Yearly costs less than monthly.
1 device
Free
Free forever
The full scanner, no account and no time limit.
Download free1 device
EUR 3/year
first year free
Complete protection for a single computer. The first year is on us.
Start your free yearPrices in EUR, VAT included. The first year is free for every new account; after that 3 EUR per year, cancellable at any time. Licences activate online or offline through an activation file. Invoicing via contact@malnox.com.
No asterisks: what is checked exists in the current version of the product.
| Feature | Malnox Free | Malnox Complete |
|---|---|---|
| Local detection engines | 17 | 17 |
| Bundled YARA rules | 67 | 67 + actualizări |
| Real-time protection | Not included | Included |
| Ransomware guard | Not included | Included |
| Cloud reputation | Not included | Included |
| Automatic updates | Not included | Included |
| Devices | 1 | 1 |
| Support | Community | 24 h |
Online with the licence key, or offline through an activation file. Both paths lead to the same product state.
The key has the format MLNX-XXXX-XXXX-XXXX-XXXX and is bound to the plan, seat count and expiry date.
Enter the key in the product or the dashboard. The device is registered and the seat is held until you explicitly release it.
For isolated environments: download an activation file from your account and load it into the product. No connection required.
Full licence details on the licence page.
The product falls back to the Free tier: on-demand scanning and quarantine keep working, real-time protection and ransomware guard switch off. We delete nothing and do not lock you out of your reports.
Yes. Deactivate the device in the dashboard, then activate on the new one. Seat usage is not tied to hardware but to explicit activation from your account.
Write to contact@malnox.com with your billing details and endpoint count. We issue company invoices with VAT, and can also issue a proforma for internal procurement.
Yes, for schools, universities and registered non-profits in Romania. Write to us from the institution's address and we will send the offer.
No, by default. The engines that decide from data shipped with the app make no network request: no DNS lookup, no phone-home, no mandatory API key. Two components can reach the network and both are opt-in: cloud reputation, which sends only the SHA-256 hash to api.malnox.com after you connect your account, and the AI analyst, disabled by default, which receives metadata only and cannot influence the verdict. With both off, a packet capture over a full scan shows nothing.
Yes. Malnox needs no special exclusions and the installer adds mutual exclusions with other security products automatically, so they do not slow each other down. The Malnox kernel driver compiles and signs in the test build but does not yet have the official signature needed to load on any Windows, so it is not enabled by default. Real protection runs in user-mode: the file is caught as soon as it lands on disk, the process holding it is stopped and the file goes to encrypted quarantine. You can keep another antivirus if you want, but Malnox does not depend on it to act.
Intel packages are versioned and HMAC-SHA256 signed. You can apply them manually, from the dashboard or through the API, and the previous version stays on disk for rollback. The update is atomic: staging in a temporary directory, then rename.
It depends on the configured action, and quarantine is the default. In short, in this order: the process holding the file is stopped (unless it is an essential Windows process), the file is moved, encrypted with AES-256-GCM (12-byte random IV, 16-byte auth tag) and deleted from disk. If the move fails, execution is denied through an ACL so it cannot run. On restore the GCM tag is verified — any modification to the blob is detected and refused. You can also choose reporting only, from settings.
The installer is 177 MB and asks for no account. Not convinced? Check a link above — the web engine is already running on this page.