Free usually means the program is the advertisement. Here is what to check before you install one, and what this one does and does not do.
There are four common models, and it is worth being able to name them. The scan is free but fixing anything is not. The scan is free and the program shows adverts. The installer brings something extra you did not ask for. Or the program sends usage data somewhere and that is the product.
None of these are illegal and some are honest about it. The problem is a scan that inflates its findings, because in three of those four models the program earns more when the number is bigger.
You can answer most of this in five minutes, without trusting anyone's marketing page.
If a program cannot survive these five questions, the number it shows you is not a measurement, it is a sales figure.
No adverts, no bundled software, no subscription, and no analytics of any kind on the site or in the program. The program makes exactly two network requests in its whole lifetime, and both are listed on the privacy page: a version check, and a licence activation that only happens if you type in a key.
A Pro tier is announced and not on sale. Because there is nothing to buy, nothing is locked — the features that were meant to be paid are simply open. The day Pro goes on sale, that changes back, and it will say so plainly rather than quietly.
Two real things, and pretending otherwise would undo the point of the whole page.
The first: the installer is not code-signed, because a certificate costs money the project does not spend. Windows SmartScreen will call it an unrecognised publisher. That is why there is a portable version — an archive you unzip and run, with no installer and no warning screen in the way.
The second: it is not an antivirus, has no signature database, and is not a replacement for one. It watches for one specific behaviour — files being rewritten in bulk — and it is honest about the limits of that.
Last updated: 2026-08-28
The catch is the unsigned installer and the SmartScreen warning that comes with it. Everything else in the program is open right now.
The background service exists for scheduled cleaning and the ransomware watch. If you want neither, it can be switched off and nothing else changes.
It runs, but it advises instead of acting. On a server it will not pre-tick anything and will not clean without an explicit instruction, because a server is not somebody's desktop.
The safe order — Windows Update, then the manufacturer, never a driver pack.
Category by category — what you get back, and what you quietly give up.
The signs that come before the ransom note — and what to do in the first minute.
Free, no account, no subscription. Windows 10 and 11.