Norman Malware Cleaner Review

Similar to the recently reviewed Dr. Web CureIt!, Norman Malware Cleaner is a free and portable security application made to identify and remove files infected with viruses, rootkits, worms, Trojans and other forms of malware that prevent the computer system from running within normal parameters.

Just like Dr. Web CureIt!, Norman does not feature a real-time shield against malware, so it cannot detect these kinds of files while they are infiltrating the system (e.g. when downloading email attachments or accessing suspicious websites). It just runs scans at the user's convenience, so it is highly recommended to team it up with another antivirus tool that integrates round-the-clock protection.

No installation required

The entire package of Norman Malware Cleaner is based on a single executable file which can be saved in any part of the hard disk and run immediately without any additional installers. It is also possible to save the tool to a removable storage device like a USB flash disk and directly run it on any PC to check for malware.

Worth mentioning is that the storage device cannot be read-only, since the app creates log files with each scan job and saves them in the same location as the executable file. Unlike most installers, Norman Malware Cleaner does not modify registry settings, so it does not increase the risk of Windows stability issues.

Plain, yet intuitive interface

Norman's interface is not glamorous but it's quite simple to navigate, since all main options are separated in multiple tabs. There are three scanning modes available: quick, full and custom. The first one looks into areas where malware is known to hide (e.g. Windows directory, Program Files), the second runs a complete scan across all local drives, while the third lets users decide the exact files, folders and drives (including removable disks) to verify.

Showing the scan modes in Norman Malware Cleaner

Select quick, full or custom scan

Configure scanning, cleaning and forensic options

By default, Norman Malware Cleaner is set to unpack archives, detect potentially unwanted programs (PUPs), run a pre-scan and post-scan routine to double-check, as well as to look into rootkits, the memory and the FakeAV Trojan. Any of these components can be deactivated for scanning.

Showing the scan optionsin Norman Malware Cleaner

Showing the clean options in Norman Malware Cleaner

Configure scan and clean optionsIn addition, users may disable automatic cleaning and objects quarantining before eliminating them, and enable rootkit cleaning as soon as it is detected. The forensic area addresses the level of security assigned to all scanning jobs. By default, Norman Malware Cleaner detects only files with high and maximum suspicion level, but it can also include the ones with minimum, low and medium level, as long as users keep in mind that this enhances the risk of identifying false positives.

Showing the forensic options in Norman Malware Cleaner

Showing the general options in Norman Malware Cleaner

Configure forensic and general optionsMoreover, the application is able to automatically reboot the computer if this is required to finalize the cleaning procedure (e.g. if the targeted object is currently used by a process), enable verbose logging, log all scanned objects, and disable multithreading. All settings can be restored to default at any time.

Showing the can results in Norman Malware Cleaner

Examine scan resultsWhile it is busy scanning, the tool shows the current status, full path of checked file, together with total scanned and malicious objects. It automatically records activity to log files and lets users pause the task and resume it at a later time. Scan results reveal the log file path, files and registry entries marked as malicious and their status (e.g. successfully cleaned), along with total scan time, number of files found, objects quarantined, and so on.

Specific files and folders may be skipped during scanning by adding them to an exclusion list. However, this can be done only prior to scanning (selected entries in the scan results list cannot be added to the list). Meanwhile, any selected items sent to the quarantine can be deleted or restored to any location on the hard disk and with a new file name. When exiting the tool after a scan, it offers to run it again at the next system startup.

Showing the exclusion list in Norman Malware Cleaner

Showing the quarantine in Norman Malware Cleaner

Exclude files and manage the quarantineNorman Malware Cleaner reserves one scanning module for advanced users: "Forensics" thoroughly scans the system to find tricky malware. It is considered dangerous because there's a risk of causing programs or the entire system to work improperly. In this case, we recommend using a backup utility that saves the current state of the OS (such as AOMEI Backupper or EaseUS Todo Backup), in order to avoid the worst case scenario when Windows becomes unusable.

Showing the Forensics feature in Norman Malware Cleaner

Use "Forensics" to run a deep scanIt is possible to view file properties, search for the file name on Google, check it for viruses by testing the file's MD5 checksum with all popular antivirus applications via VirusTotal, exclude it from future scans, modify the default suspicion level, and so on.

Performance results

We put Norman Malware Cleaner to the test on an Intel Core i5-3470 with CPU @3.20GHz and 12GB RAM, running on Windows 8.1 Pro, in order to evaluate scan time and virus detection ratio. We submitted 8,502 files with virus samples with a total worth of 2.36GB and ran a custom scan with default settings.

The application took a painfully long time to finish the scan job: 1 hour, 22 minutes and 44 seconds. It removed 7,222 infected files and left behind 1,290 files, resulting in a success ratio of roughly 85%. Afterward, we ran a new scan by including files with minimum, low and medium suspicious level, but there were no changes. CPU and RAM were highly used.

The Good

The tool does not require installation and it is very simple to use by those with no previous experience in antivirus applications. At the same time, Norman Malware Cleaner provides advanced users with configuration options that revolve around the scanning and cleaning behavior, a quarantine for managing suspicious files, an exclusion list for false positives, along with a powerful forensics module for thorough scanning.

The virus detection ratio was good in our evaluation. Scan statistics may be examined in log files.

The product is free to use.

The Bad

The scan time is very slow, while CPU and RAM usage is significant.

Its interface could use some work in the cosmetics department.

The Truth

Users may resort to Norman Malware Cleaner as a secondary line of defense against viruses, worms and other types of malware, as long as they keep in mind that it cannot replace a full featured antivirus application. Running it from time to time may reveal some infected files that were missed by the primary antivirus, so it's worth keeping around.