AV requirements is dependant on user knowledge and common sense/safe practices (novices/pro) & how likely you are to visit risky sites and install risky software, or get easily fooled by clicking links from social media/ads/emails.
Any of the top bloated packages from Kaspersky/Bit Defender etc should do most people fine, they come with lots of addons to help protect browser extensions/vpn/firewall/hips/password managers/etc etc... but also at the risk of 3rd party software causing issues with stuff or incompatibility etc & then yearly subscriptions etc.
People seem to think that Antivirus is your main protection and will keep the computer safe no matter what you do.
For myself AV is last on that list, its the last line not the first line, more important first...
- Secure Gateway/firewall with IDS/threat detection & most importantly Geoblocking... 95% of the world im not interested in connecting to, and only the country I reside in or holiday in should be allowed inbound/vpn....
- VLAN & segregated networks.. keep your crap iOT devices/CCTV/guests etc off your production/trusted network
- Secure DNS / Adblock per machine, or ideally Network wide with Pihole
- Updates for OS & Firmwares to avoid any vulnerabilities should be patched ASAP, any router that is EOL should be binned.
- Backup often, at least 2 copies, ideally 3..... and 1 MUST BE immutable and /or offsite
- Passwords (obvious one) should be random/secure & different for every product/service & 2fa authenticator or yubikey where possible
- Use broswer extension to help with obvious phishing sites
- Harden the OS with Hard Configurator or SRP
at this point, practicing safe browsing and not being click happy... unless its BIG 0-day there is no virus getting on my system, unless stuxnet/sasser/state 0day and even then it would be down to a vulnerability of either my firewall or OS (hence why patching is critical asap)...
So the most likely way is if I was stupid and just started installing unknown risky software or clicking random links in mails/chats, so 99.9% the only way i'd be getting a virus is down to my own stupidity.
So im not looking for any noisey package with all the bundled rubbish that has "the best gui" I want something silent, reliable & there as a last resort to warn me of possible infection (in the random event id get infected, the machine would be turned off... restored... network checked over as to why)
this poll is missing probably the best product of all especially for security Pro's (maybe not so much for click happy novice's) (Microsoft defender) it has excellent detection, quiet, no subscription, can be VERY secure when hardened.
after much testing in the past weeks, & ive tried a few (but my tests have only concentrated on running .exe) not phishng/browsing/scripts/office etc
- ESET AV - Ransomed
- Kaspersky Cloud Free - Missed 2 minor things
- Sophos Home - Drive wiper Malware, game over for VM
- Norton 21.x & retested with 22.2 - Protection quit, seems to get overwhelmed, machine totally compromised
- G-Data - too slow at detection/remediation, and missed items
- BitDefender Free - Missed a few items (Total security passed 100% though)
- Emsisoft - Missed couple of items, minor
- F-Secure Safe - Passed 100%
- Avast Free - Passed 100%
- Arcabit - almost passed missed 1
- K7 - missed a couple
- Webroot - Total fail
- WisevectorStopX - Missed a few on default, Passed 100% on High mode
- Malwarebytes - 100% passed
- Windows Defender - Defaults missed a few....... Hardened 100% pass but have retested numerous times and have had the odd miss... so its not bulletproof
Where some of the above maybe better than defender is their behaviour blocking/dealing with an already infected machine maybe, but thats no interest to me, if a machine was infected it would be off/restored... I wouldn't want to trust a previously compromised machine, I want ZERO chance of execution of malware in the first place not allowing it, then cleaning up.
SO windows Defender is not perfect, it does miss things even fully hardened with ASR etc in 10-15 tests ive had 100% passes and some misses.....would I recommend Defender to my mum/dad/novice users? probably not by itself!
So my Vote and its what I use on my production machines and ive never actually needed to see it working as ive not had a virus (but extensively tested on my Samples testing VM)
Windows Defender with.......... DefenderUI Pro by
@danb - this combination is a total winner.. Windows defender does its thing, and any odd .exe corrupt/missed gets flagged up by defenderUI Pro, which then checks in its Whitelist cloud for a second opinion and blocks it..
every single test with many fresh samples with defenderUI "PRO" in place has resulted in 100% Zero executions, 100% of the time.
you could also use voodooshield along with any other AV to help it out with any misses.. great software.
Anyway thats my rant over.... now which has the prettiest GUI again?