Zemana AntiMalware Review 2026: Do Not Install 3.2.28

Zemana is downloadable and sellable, but not demonstrably maintained

This is an unusual lifecycle failure. The vendor domain hasn't disappeared. The official AntiMalware page still promises a fast PC scan and removal of malware, adware, unwanted applications, toolbars and browser add-ons. Its download button returns a Windows executable. Its Buy link still reaches a payment cart.

Yet every maintenance signal is stale. The last named release is 3.2.28 from March 2021. The download server says the current EXE was last modified in March 2022. The privacy page footer ends at 2022. We found no current Windows 11 requirements page, no current security bulletin, no patched successor to 3.2.28 and no current direct lab test.

We hashed the official payload without executing it

Review pages and download directories often stamp a current date on the page while serving the same old binary. We therefore checked the actual official endpoint. It delivered a 13,922,376-byte PE32 Windows installer with SHA-256 b548f01428cb26a5870602e8018adbce814dd2ed53a6b1f74c3b3b7bf23fa965. The same hash and size are listed by established download archives for Zemana AntiMalware Free 3.2.28.

We didn't execute the installer. After hashing, it was isolated locally with no permissions. Readers don't need to reproduce that check: deliberately downloading a known-old security installer adds risk without proving that its cloud service, license activation or driver is safe.

The server's Last-Modified header says March 30, 2022, while the vendor release note dates 3.2.28 to March 31, 2021. A changed server timestamp doesn't create a newer software version. The vendor's changelog controls the public release claim.

An antivirus doesn't get a pass for carrying its own unpatched kernel risk

Security software operates with exceptional privileges. Zemana's driver can interact with processes, disks and kernel memory so the product can inspect or remove stubborn malware. A defect in that trust boundary can give an attacker the same powerful access.

A normal application might remain useful after five quiet years when its input surface is small. An antivirus is different: malware techniques, Windows driver rules, cloud reputation data, certificates and operating-system internals change continuously. A five-year-old client needs a clear supported lifecycle and patched driver—not merely a working download link.

Even if on-demand scanning still returns detections, detection is only one side of the decision. Installing an old privileged component to find threats can increase the attack surface. Current Defender plus a maintained second-opinion scanner is the safer architecture.

Published vulnerabilities name version 3.2.28

The version match is decisive. NVD's CVE-2022-42045 record says certain Zemana products are vulnerable to arbitrary code injection and explicitly lists Zemana AntiMalware 3.2.28. NVD scores it 6.7/10 (Medium): exploitation is local, requires high privileges and can affect confidentiality, integrity and availability.

The researcher's driver analysis documents both CVE-2023-36204 and CVE-2023-36205, their affected versions and IOCTL paths. The local prerequisites matter: these aren't drive-by remote attacks that compromise a clean PC merely because it visits Zemana's site. But a local privilege boundary is exactly what post-compromise malware tries to cross. A security product should close that path quickly and publish the fixed version. We found neither a later release nor a vendor advisory explaining mitigation.

Why attackers use Zemana's signed driver to kill other defenses

Bring Your Own Vulnerable Driver (BYOVD) is a defense-evasion technique. Malware first obtains enough access to place and load a legitimately signed but vulnerable driver. It then sends driver commands that ordinary unprivileged code couldn't perform, such as opening protected processes or terminating antivirus/EDR services.

Sophos' Terminator analysis identifies zam64.sys from Zemana AntiLogger and zamguard64.sys from Zemana AntiMalware. The drivers share a similar code base and insufficiently verify which process may issue privileged IOCTL commands. Sophos later observed a customized Terminator sample and signed Zemana driver in 2025 incidents.

This distinction prevents two opposite mistakes. The driver was originally legitimate; finding its normal name after a known Zemana installation doesn't by itself prove malware. But a valid signature doesn't make a vulnerable old driver safe, and attackers can rename the copied file. Treat an unexpected alert as an incident clue, not a simple false positive.

Microsoft's vulnerable-driver guidance recommends the blocklist and the Attack Surface Reduction rule that blocks abuse of exploited signed drivers. Windows 11 22H2 and later enable the blocklist by default, but Microsoft notes that no list can guarantee coverage of every vulnerable driver.

Is Zemana AntiMalware a virus?

The official Zemana AntiMalware installer isn't proven malware. Zemana was a legitimate Turkish security vendor, the product had a real user base and its components were signed. A vulnerable driver can be non-malicious code with dangerous access-control defects.

Defender and other products may detect zamguard64.sys as a vulnerable-driver or Spyboy-related risk because attackers reuse it. The label describes exploitability or observed abuse, not necessarily an infection of Zemana's original file. Context controls the response: did you install Zemana, is the file in its expected path, is the signature/hash expected, and are there unknown loaders, services or renamed drivers nearby?

None of that supports installing 3.2.28 now. “Not a virus” is a much lower bar than “safe, maintained security software.” The current recommendation remains removal and replacement.

No formal EOL notice was found, but every public clock stopped years ago

Zemana's release feed once documented frequent stable and beta builds. It now ends with a one-line Windows 10 20H2 crash fix for 3.2.28. The product page still asks which feature users want next, while the privacy footer says ©2007–2022. The support form and email remain online, but no current support matrix, SLA or security-advisory archive was found.

That evidence doesn't justify an invented announcement that “Zemana shut down.” The narrower conclusion is stronger: no publicly verifiable maintenance for the consumer Windows AntiMalware client after March 2021, despite continuing distribution and sale.

For security software, the burden is on the vendor to show a patched current build. Silence can't be converted into an assumption that cloud definitions alone solve client and driver vulnerabilities.

What Zemana 3.2.28 was designed to do

The old feature set explains why users liked it. Zemana was a focused malware cleaner rather than a suite full of VPN, password-manager and parental-control modules. A large Scan button sent file fingerprints and metadata to IntelliGuard cloud reputation services; detections could be removed, quarantined, whitelisted or reported as safe.

Old reviews also promised compatibility with any antivirus and no system impact. Those absolutes were never safe. Two security tools can conflict over drivers, process hooks and quarantine. A current on-demand scanner can coexist when its real-time module is off; that architecture doesn't rescue an unpatched client.

No current direct Windows protection test supports Zemana

We checked current AV-TEST Home Windows material, AV-Comparatives' consumer Windows tests, SE Labs home reports and current MRG Effitas consumer reports. We found no current direct test of Zemana AntiMalware for Windows.

The old page dismissed lab results and replaced them with an undocumented claim that Zemana detected every sample on a review PC. That isn't reproducible evidence. We removed it. A scanner needs current malware sets and current false-positive measurement; “cloud based” doesn't make its model timeless.

Windows 11 support isn't verifiable from current vendor documentation

The last release note fixes a crash on Windows 10 version 20H2. Old pages list Windows XP, Vista, 7, 8 and 10. We found no official current statement for Windows 11 24H2/25H2, current Memory Integrity or modern vulnerable-driver enforcement.

A third-party directory saying “Windows 11” isn't a vendor support commitment. A program may launch while its driver is blocked, its real-time layer is inactive or its uninstaller leaves incompatible services behind. Current Microsoft community reports describe old Zemana drivers blocking Windows upgrades after the app was removed.

Don't weaken Memory Integrity or the vulnerable-driver blocklist to make an old security product run. The operating system is correctly prioritizing a newer trust policy over a stale utility.

The old store still takes orders for a one-year subscription

The vendor's Buy AntiMalware route is a 334-byte meta/JavaScript redirect last modified in April 2022. It points to a live 2Checkout product labeled “Zemana AntiMalware Subscription 1-PC / 1 Year.” In our German checkout session on July 14, 2026, the amount was €18.35 before VAT and €21.84 including 19% VAT.

We didn't complete a purchase. The cart's ability to accept billing details isn't proof of a maintained binary, current support or a patched driver. We strongly advise against paying. This review omits Offer schema because promoting a purchasable price for an unsafe old security build would mislead searchers.

Old reviews list $29.95 for one PC, multi-device/three-year tiers, PayPal and a 30-day guarantee. Those numbers aren't the current cart observed. If you already paid, use the order confirmation and processor account rather than an old review's pricing table.

The free scanner isn't a safe workaround

Historically, Zemana AntiMalware Free kept on-demand detection/removal while a 15-day Premium trial enabled real-time and ransomware layers. The old free workflow was attractive because it was small and didn't need to become the primary registered antivirus.

In 2026, “free” doesn't change the client version. The official free/demo download is the same stale product channel. Even an on-demand tool can install services or drivers and exchange data with cloud infrastructure. Use a maintained free scanner instead.

Don't fetch a “portable Zemana” from a mirror. The old page confused portability with a consistent interface across Windows versions. A truly portable emergency scanner should come from the current vendor, publish fresh signatures/build dates and avoid persistent drivers when possible.

IntelliGuard sends file and device metadata to the cloud

Zemana's privacy policy says software events can transmit the action taken, MD5 file hash, digital signature, file size and version information to IntelliGuard. It also lists standard computer information including IP address, operating system and version. The vendor describes the threat data as anonymous and uses it to classify safe/malicious files and produce statistics.

The policy also names Google Analytics, 2Checkout, Mailchimp and, for certain purposes, a Bitdefender Antivirus SDK. That last reference doesn't let us assign current Bitdefender protection scores to Zemana: the policy doesn't document the precise current engine/version or license lifecycle.

Cloud metadata can be appropriate for malware reputation, but it makes lifecycle transparency more important. The policy says IntelliGuard may have maintenance downtime; it doesn't expose a current definitions/model date or service-status history. An old client with an opaque current backend isn't independently verifiable.

Recent community evidence points to maintenance and support trouble

G2 has only three Zemana AntiMalware reviews, latest in 2023. They praise fast scanning and simplicity but are too few and too old to establish current efficacy. Trustpilot's sparse recent posts include license-expiry and unresolved-support complaints. Those reports are individual accounts, not verified lifecycle records.

Security communities have called the consumer products abandonware since 2022 and repeatedly ask why Defender detects zamguard64.sys. The underlying concern is supported by the release/CVE timeline, but community shorthand often mixes Zemana AntiMalware, AntiLogger, MalwareFox and other SDK-based products.

No community aggregate appears in our schema. The verdict rests on named version, release history, published vulnerabilities and current independent-test absence—not a handful of ratings.

If Zemana is installed, record evidence before changing it

1. Disconnect from sensitive work if an alert is unexpected. Don't sign into banking or admin accounts while investigating a possible defense-evasion event.
2. Record the product and build. Capture Zemana's About/License screen, last scan/update, account email and order number.
3. Check active protection. Open Windows Security → Virus & threat protection → Manage providers. Confirm Microsoft Defender or another current primary antivirus is active.
4. Save detection details. Record the exact filename, path, hash, signature and detection name for any zamguard64.sys/zam64.sys alert.
5. Stop renewal separately. An uninstall doesn't necessarily disable a 2Checkout subscription.
6. Uninstall normally and reboot. Then verify the active provider, Memory Integrity and updates.

Don't whitelist the driver merely because Zemana originally signed it. Don't delete a random kernel file while its service is active. A bad manual removal can break boot, Windows Update or the provider registry.

Uninstall Zemana first, then handle remnants conservatively

Open Settings → Apps → Installed apps (or Control Panel → Programs and Features on older Windows), select Zemana AntiMalware and run Uninstall. Close the interface, allow the vendor uninstaller to remove its services and restart. Don't install a third-party “Zemana removal tool” from a download portal.

After reboot, check Windows Security. Turn on Microsoft Defender, update security intelligence and verify Windows Security → Device security → Core isolation → Memory integrity. Check browser extensions and startup entries. Windows may retain an old driver package even after the visible app is gone.

If Windows still flags zamguard64.sys, records Zemana as an antivirus provider or blocks an OS upgrade, don't copy-paste a registry or sc delete recipe blindly. An experienced administrator can use pnputil /enum-drivers, service inventory and Code Integrity logs to identify the exact published INF/publisher before removal. Home users should take a backup and use Microsoft support or a reputable repair technician. A clean Windows install is the last resort when deep remnants and upgrade damage can't be resolved reliably.

Cancel through the 2Checkout order, not the deleted application

Search email and card statements for Zemana, 2Checkout, Avangate or Verifone, then locate the order number. 2Checkout's current subscription email includes the billing cycle, next amount/date and a MyAccount link for canceling the next automatic charge. Log in from the official 2Checkout domain and disable renewal; keep the confirmation.

If the license expired early or support doesn't answer, open a shopper case with 2Checkout using the order number. Its current refund policy says requests can be submitted through MyAccount or processor support and are generally considered within 14 days, case by case. Product access and local consumer law can change the outcome.

Don't send card credentials to a phone number copied from an old review. Use the payment-processor receipt/account. Contact the card issuer when a charge is unauthorized or the identifiable merchant/processor fails to resolve it.

An unexpected Zemana driver alert needs an incident check

If Zemana was never installed, or the flagged driver has a random filename/path, assume neither “false positive” nor “full compromise.” Preserve the alert and investigate. Terminator-style tools may rename the copied driver and normally require another loader/process to exploit it.

1. Disconnect from networks that expose sensitive business or identity data.
2. Run Windows Update and update Defender security intelligence.
3. Run a full scan, then Microsoft Defender Offline.
4. Use one maintained second-opinion scanner; don't stack several real-time products.
5. Review Code Integrity, service creation and security-product termination events around the first detection.
6. From a known-clean device, rotate privileged credentials and revoke sessions if compromise is plausible.
7. Escalate to workplace security/forensics when EDR was disabled or business data was present.

The existence of the known driver on an old disk may be only a remnant. Evidence from an active system—unknown loader, renamed driver, terminated defenses or persistence—raises the severity.

Who should use Zemana AntiMalware in 2026?

No new user should install 3.2.28. That includes people seeking a free second-opinion scan, a ransomware layer, browser-hijacker cleanup, Windows 11 protection or a lightweight tool for an old PC.

Existing users should treat the product as a migration task. A malware analyst may retain a sample inside an isolated lab for research, with no production credentials or network trust. That isn't ordinary consumer use and doesn't justify a download CTA.

Businesses should inventory Zemana/AntiLogger/SDK-derived drivers, current hashes, signing information and vulnerable-driver controls. Don't equate a driver name alone with compromise; correlate it with authorized software and execution telemetry.

Maintained Zemana alternatives cover the same jobs

Our malware-removal guide compares current tools and explains when reimaging is safer than repeated cleaning. Whatever you choose, keep one primary real-time antivirus, patch Windows and browsers, enable MFA and maintain offline/versioned backups.

Final verdict: a live download isn't a maintained defense

Zemana AntiMalware once filled a useful niche: a simple cloud-assisted scanner that could remove PUPs and stubborn malware alongside a primary antivirus. Its focused interface and small footprint explain the lingering recommendations.

That product can't pass a 2026 safety review. The last public build is 3.2.28 from 2021; the official endpoint still serves the old payload; published vulnerabilities name that version; vulnerable Zemana drivers have been repurposed by attackers; no current direct Windows lab result or current Windows 11 support statement was found. Keeping the checkout online makes the gap worse, not better.

Zemana AntiMalware scores 1.0/10 for a new installation. The single point recognizes a real historical product and functioning legacy pages, not current protection value. Don't install or buy it. Existing users should cancel through the processor, uninstall normally, verify driver removal and migrate to a maintained primary and second-opinion tool.