However, I think it is equally important how an AV handles malware once it is on the system.
For example,
Webroot monitors any unrecognized files... it can terminate, block and reverse either automatically or user-defined.
Comodo auto-sandboxes unrecognized files and monitors some others... it can terminate, block and reverse automatically a limited number.
Kaspersky assigns unrecognized files to Low and High restricted and monitors some... it can terminate, block and reverse automatically a limited number.
ESET essentially does the same as Kaspersky, but does not have a malware reversal module at this time.
Emsisoft's Behavior Blocker will monitor apps and alert to any pre-defined suspicious behaviors.
Comodo, ESET and Kaspersky have classical HIPS which will alert the user if something Unrecognized on the system suddenly "comes alive."
Webroot will alert to registry and certain data access.
Each of the above has a firewall to alert to outbound connections.
Clean-up routines are a different matter and vary widely between the different vendors. Kaspersky and BitDefender are purportedly the best at system clean-up, but I think the use of 3rd-party utilities (e.g. Farbar, ComboFix, etc, etc) is a well-established practice for best results. Their use should not reflect negatively on any AV software.
Kaspersky, as a vendor, is good about creating malware-specific removal tools. Most AV vendors do it, but K is does it more than others.
Norton was great til Norton Security. Always did relatively good for me. I looked at its defin. vs NIS, didn't do as well as NIS with up to date definitions for some reason.