A perfect antivirus tool would eliminate all malicious software while treating valid programs with loving care. In the real world, though, malware sometimes slips past antivirus protection or gets embedded in the system and interferes with installing protection. Malwarebytes Free aims to clean out preexisting malware and hunt down malicious programs that evaded your regular antivirus. It’s not meant to be your only protection, however—you should use it alongside a full-powered free antivirus like Avast One Essential or AVG AntiVirus Free, our Editors’ Choice winners for free antivirus protection.
Getting Started With Malwarebytes Free
When you install the free edition, you get a 14-day trial of Malwarebytes Premium. If you let the trial expire without upgrading, you lose quite a few features. In particular, the free edition, reviewed here, doesn't include any real-time protection. It does just one thing: clean up existing malware problems. For testing purposes, I dug into account settings and declined the Premium trial.
After a quick installation, the simple main window appears. A banner across the top reports status and offers advice, while three large panels along the bottom offer access to Detection History, Scanner, and Real-Time Protection. As noted, the real-time protection feature is premium-only—so is scheduled scanning. Above these panels is an area that provides status information and advice. Just after installation, it recommends launching an initial scan. By default, the display uses a faintly patterned light gray background, with elements of white and blue. If that’s too bland, you can switch to dark mode or choose a different background.
New since my last review is the Trusted Advisor feature, reached by clicking the status pane in the main window. Much like the AutoPilot feature in Bitdefender, Trusted Advisor reports on the status of your protection and offers advice on how to do even better.
Similar Products
Avast One Basic
AVG AntiVirus Free
Bitdefender Antivirus Free for Windows
Avira Free Security
Microsoft Defender Antivirus
Premium Edition Gets Good Lab Scores
Simple-minded signature-based malware detection alone isn't enough in the modern world of zero-day attacks and polymorphic malware. Every successful antivirus adds heuristic detection, behavior-based detection, and other non-signature protection layers. In Malwarebytes Premium, machine learning and detection of anomalous behavior catch many malware samples. Exploit protection watches attack vectors and heads off exploits. The Premium Edition's anti-ransomware engine strictly uses behavioral detection.
This emphasis on active, prevalent threats and advanced detection methods sometimes makes testing Malwarebytes tough. A lab test that uses outdated samples could make the antivirus look bad. In the past, Malwarebytes rarely participated in lab testing. More recently, though, it’s been showing up in tests from several labs, and earning impressive scores. Remember, though, that these tests evaluate Malwarebytes Premium, not the free edition reviewed here.
Malware experts at AV-Test Institute rate antivirus utilities on three criteria, protection, performance, and usability. Here usability refers to avoiding erroneous identification of valid apps or websites as dangerous. Malwarebytes earned the top score, 6 points, for performance and usability, and took 5.5 points for protection. Its total score of 17.5 points earns it the title Top Product. Bitdefender and F-Secure also have 17.5 points in this latest test. Half the tested antivirus utilities own a perfect 18, among them Avira, Microsoft Defender Antivirus and Norton AntiVirus Plus.
Reports from AV-Comparatives list certification levels rather than numeric scores. An app that passes one of this lab’s numerous tests achieves Standard certification; those that fail get the label Tested. An app that goes beyond the minimum requirements for certification may rate Advanced, or Advanced+. Over a third of programs tested earned Advanced+ in all three tests, among them Avast Free Antivirus, AVG, and Bitdefender. Malwarebytes doesn’t show up in the latest reports from this lab, though it has in the past.
It's Surprisingly Easy to Be More Secure Online
While most lab tests report results on a scale of one kind or another, those from MRG-Effitas lean toward pass/fail. In this lab’s assessment using all types of malware, programs that fend off all attacks immediately get Level 1 certification, while those that eliminate all malware traces within 24 hours pass at Level 2. A separate test specific to banking-related attacks is strictly pass/fail. Malwarebytes passed the latter and reached Level 1 in the former, a fine success.
Passing those scores through my aggregate lab score algorithm yields an impressive 9.8 points for Malwarebytes, though AVG, also tested by two labs, reached a perfect 10. Among those tested by three labs, Kaspersky and McAfee join the winners’ circle, also with 10 points each. Bitdefender is one of just four antiviruses evaluated by all four labs, and its 9.9-point score is nearly perfect.
These tests show that the labs consider Malwarebytes Premium important enough to test, and that it exhibits success in testing. However, they’re not directly applicable to this review, because they evaluate an antivirus tool’s ability to defend against malware attack using real-time protection. You call on Malwarebytes Free for those occasions when your real-time antivirus failed to defend you, perhaps because you forgot to renew it. Malwarebytes Free does not itself offer any real-time protection.
Can’t Help With Ransomware
With the rise of ransomware attacks on businesses, governments, and individuals, ransomware protection is more important than ever. However, ransomware is intrinsically different from other kinds of malware. Most types of malware want to use your computer's resources, whether for mining bitcoins, launching DDoS attacks or stealing your personal data. Typically, they aim to avoid notice, which means they carefully avoid any visible harm to the computer. A post-infestation antivirus cleanup can scour the malware from your computer's crannies and crevices, restoring it to a safe, secure state.
Ransomware, on the other hand, only stays quiet until it has done its nefarious work, locking away your important files in unreadable encrypted form. Once finished, it displays its ransom terms. Removing the ransomware at this point doesn't help. It could even interfere with your ability to get your files decrypted, should you decide to pay the ransom. Malwarebytes Premium eliminates ransomware before it attacks; Malwarebytes Free can't do anything once your files are already transformed into encrypted gibberish.
Effective Malware Detection
Usually, I test malware protection by challenging an antivirus utility to prevent the installation of my malware sample collection. However, as noted, Malwarebytes Free doesn't include real-time protection. With no help from the labs, I had to find some way to see the antivirus in action. So, skipping the ransomware, I launched my samples four or five at a time, gave them time to finish installing, and challenged Malwarebytes to clean up each mess.
At the end of every full scan, Malwarebytes displayed its findings; I used these details to identify exactly which of the samples it detected. In every case, I told it to quarantine everything it found, and in every case, it requested a reboot to finish the process. After reboot, I ran a utility that reports on any leftover malware traces.
The time to complete a scan ranged from just over 2 minutes to just over 10 minutes, with an average of 5 minutes. That’s a bit longer than the 90-second average from my previous review, but it’s blazingly fast compared to the current average full scan time of nearly 2 hours.
Malwarebytes detected 96% of the samples, reporting anywhere from a handful of files to many dozens. Its quarantine process removed all the traces it detected. However, I found that it left a lot behind. For fully half the samples, it failed to clean up one or more executable files. In another 5% of cases, an executable associated with the malware was still running. In many cases, even when it wiped out all executable files, it left behind up to 100% of non-executable traces. Admittedly, those traces can’t actively harm your system, but gunking things up with malware-related files and Registry entries can’t be good for performance.
That high detection rate is important for a cleanup-only antivirus like Malwarebytes. Its purpose is to get rid of persistent and pernicious malware that’s preventing you from installing protection, or that got past your protection. After a scan by Malwarebytes, you should be able to get a full antivirus utility installed or get your existing antivirus to clean up the remaining mess.
For a different sort of test, I rolled back the virtual machine testbed to a snapshot before any malware samples were launched and ran a full scan. Malwarebytes detected and quarantined the same 96% of samples, and also wiped out every ransomware sample. If you’re lucky enough to run a scan between the time ransomware enters your system and the time it springs into action, the free scan could help, at least in theory.
Admittedly, my hands-on tests don't precisely simulate the real-world malware cleansing that is a Malwarebytes specialty. Normally, you'd bring in Malwarebytes to handle an attack that eluded your existing antivirus or that put up roadblocks to the installation of a more traditional antivirus. The high-tech behaviors and technologies that such an infestation requires would be a red flag for Malwarebytes. A potentially unwanted program (PUP) or other less-risky sample accidentally launched by the user might not raise the same concerns.
Browser Guard for Online Protection
When you install Malwarebytes, whether free or Premium, it prompts you to add the free Browser Guard extension for Chrome, Edge, and Firefox. Even if you skip this step at installation, you can download the extension later. Browser Guard aims to protect against malware-hosting URLs, ads and trackers, tech support scams, sites with bad reputations, and more. I put those aims to the test.
As far as ad-blocking goes, it seems to do the job. I installed Browser Guard in Chrome, then visited several ad-laden sites in both Chrome and an unprotected browser. The extension visibly removed ads. By clicking its toolbar icon, I could view specifics about ads and trackers on the current site or check statistics of past activity. The list of trackers is interactive—if you trust any of the tracking sites, you can click it so Malwarebytes will stop blocking it. I doubt many will take advantage of this fine-tuning, though.
My malicious URL blocking test uses a feed supplied by London-based testing lab MRG-Effitas, consisting of malware-hosting URLs discovered in the last few days. Most antivirus tools get two chances to fend off a malware download. First, they can divert the browser away from the malware-hosting URL. Second, they can eliminate the malware payload. With no real-time protection, Browser Guard only has one opportunity.
I found that when Browser Guard blocked dangerous pages, it explained why it did so, stating that the page contained a Trojan, or riskware, or a suspicious download, for example. In some cases, the malware download started, only to be interrupted by Malwarebytes detecting suspicious content. It protected against 95% of the dangerous downloads, mostly by blocking all access to the malware-hosting URL.
That 95% score puts Malwarebytes in the top third of tested products, which is quite good. Even so, six antivirus tools have scored 100% in their latest tests, among them Sophos Home Premium, McAfee AntiVirus Plus, and the Chrome-specific Guardio.
After a few files reached the Downloads folder, Malwarebytes popped up a suggestion that I run a scan on those files. So, on completing the test I ran a scan on the handful of files that reached the Downloads folder. That scan detected and quarantined them all. An on-demand scan isn’t part of this test, but Malwarebytes put on an encouraging performance.
Browser Guard Detects Phishing Frauds
I also put Browser Guard through my standard phishing protection test. Phishing sites don’t try to infest your computer with malware. Rather, they masquerade as popular secure sites, hoping they can entice you to log in. If you do, you’ve given the fraudsters your login credentials. Whatever the account was, whether for online banking, dating, email, or some other purpose, the creators of the phishing page own it now.
For this test, I scrape hundreds of recently reported fraudulent URLs from pages that collect and analyze such things. I make sure to include both verified phishing pages and pages that haven’t yet been analyzed and blacklisted. I use a hand-coded tool to launch each URL simultaneously in four browsers, one protected by the antivirus under test and the other three by the built-in protection of Chrome, Edge, and Firefox. The testing tool also lets me record how each browser handled the URL.
Do keep in mind that every time I run this test, I necessarily use a different set of test URLs. But in each case, they're the freshest ones available.
If any of the four browsers don’t load a page, I discard it. If any alleged phishing page doesn’t truly fit the profile, meaning it doesn’t try to steal your login credentials, I discard it. After processing all the URLs, I calculate the scores.
Malwarebytes treated most of the phishing pages in much the same way it did malware-hosting pages, offering various reasons for blocking access including Phishing, Malware, and Reputation. In many cases, it reported that it had blocked “potentially malicious activity,” thereby making the page safe for a visit. I treated these as successful detections. But would you want to visit a web page that required disinfection?
Malwarebytes scored an impressive 99% in this test, the same as Bitdefender Antivirus Plus scored in its latest phishing challenge. Only five programs reached 100% detection, among them Avast, Norton Genie, and ZoneAlarm Free Antivirus.
Keep Malwarebytes Free in Your Toolbox
Malwarebytes Free remains a useful tool. If you carry a thumb drive full of security tools, do include Malwarebytes. But remember, it offers no real-time protection, so it can't help you with ransomware. Use it along with Avast One Essential or AVG AntiVirus Free (both Editors’ Choice winners for free antivirus), or another antivirus that provides real-time protection. Bring out Malwarebytes when your regular antivirus slips up or you need to help a friend. We no longer declare an Editors' Choice winner in the cleanup-only category, but Malwarebytes remains a top option.
Malwarebytes Free does a good job of rooting out malware that got past your antivirus or that’s keeping you from installing an antivirus update.
Like What You're Reading?
Sign up for SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.
This newsletter may contain advertising, deals, or affiliate links. Subscribing to a newsletter indicates your consent to our Terms of Use and Privacy Policy. You may unsubscribe from the newsletters at any time.
Thanks for signing up!
Your subscription has been confirmed. Keep an eye on your inbox!
Sign up for other newsletters
