Using ZeroWrite

Installing

Download the installer from the download page and run it. Installation requires administrator rights because ZeroWrite registers a Windows service — ZeroWriteService — which does the actual interception. The desktop application is the interface to that service, not the protection itself.

The two components share a local database. If you ever see the app reporting that the service is not running, protection is not active, and reinstalling is the fastest fix.

How a verdict is reached

Every arrival path funnels through the same three stages.

1. Intercept. Execution is suspended before the first instruction. This covers files written to disk, processes being spawned, scripts, and code injected directly into memory.
2. Analyse. The engine parses the executable, simulates what its code paths would do, and scores intent. YARA rules and SHA-256 reputation corroborate that score. Analysis is local — there is no cloud round trip in the decision path.
3. Decide. A risk score from Low to Critical is produced, typically in under three seconds. Critical items are dissolved automatically. Everything else surfaces for your decision.

Acting on an alert

Four actions are available on any intercepted item:

• Allow — release it and remember the decision.
• Quarantine — move it somewhere it cannot execute, reversibly.
• Delete — remove it permanently.
• Isolate — cut the machine off the network while you investigate.

Every action is written to a local event history you can review later. That history stays on your machine.

Quarantine

Quarantined files are stored so they cannot execute and can be restored if a verdict was wrong. Uninstalling ZeroWrite deletes the quarantine store, so restore anything you want to keep before removing the product.

Updates

Two things update independently. Rule packs refresh frequently in the background and reload without restarting anything — see rule packs for how they are signed and verified. Application updates are checked at launch and daily, and are never installed silently; you will see a notice and choose when to apply it.

Trials and licensing

A 14-day full trial starts on first run with no key and no card. After that, Personal is free for individual non-commercial use, and paid plans are activated by pasting a licence key into Settings → License.

The key is exchanged for a signed entitlement token that is verified on your machine. That is why protection keeps working when you are offline or when our servers are not reachable.

Each licence covers a set number of machines. Deactivating an install frees its seat for another machine.

When a subscription lapses

Protection does not stop. After the grace period the engine keeps working with the rule pack it already has; rule-pack updates and new versions stop, and the app shows a clear notice. After a long lapse it reduces to on-demand scanning. It will never silently go dark.

Privacy in practice

File contents never leave your machine. Telemetry is split into three separately consented categories, and threat-data sharing — hashes of blocked items — is off unless you turn it on. The full detail is in the privacy policy.

Uninstalling

Use Add or remove programs in Windows Settings. The uninstaller stops and removes the protection service. Restore anything you need from quarantine first.

Something missing here? Ask us — gaps in this page are treated as bugs.