The best Home AV protection 2019-2020

[Andy Ful]

Real-World tests include fresh web-originated samples.
Malware Protection tests include older samples (several days old) usually delivered via USB drives or network drives.

Real-World 2019-2020: SE Labs, AV-Comparatives, AV-Test (7659 samples in 24 tests)

-------------------Missed samples
Norton 360..................8
Trend Micro IS............13
F-Secure, Kaspersky...19
Avast, Microsoft.........37
Avira (Free, Pro).........46
McAfee (IS,TP)...........76


Malware Protection 2019-2020: AV-Test, AV-Comparatives (224173 samples in 16 tests)

-------------------Missed samples
Norton 360.............4
Microsoft.............. 25
F-Secure Safe........26
Kaspersky IS.........28
Avira (Free, Pro)....37
McAfee (IS,TP).....37
Avast Free............59
TrendMicro IS.......257

Why I used two years period?
The results of any single test made by SE Labs, AV-Test, or AV-Comparatives are useless for comparing AVs. In most cases, the statistical errors allow only saying that the group of 10 first AVs can be awarded. This follows from a too-small number of tested samples. I noticed that even the period of one year is not sufficient. For example:

Real-World: SE Labs, AV-Comparatives, AV-Test
--------------2019----2020------
Avast Free...............26..............11
Microsoft................12..............25

The one-year results are totally different, but the two-year results are the same.
On the other side, the AV protection is changing in time. So, it would not be reasonable to increase the period above two years.


Some thoughts about these results:

• The entries with the same color cannot be differentiated due to statistical errors.
• The differences between AVs are very small and they can hardly be noticed by the home user.
• In some cases, the differences can be leveled by tweaking the AV settings.

The case of Trend Micro shows that the test results in the same (or similar) category can be totally different for two AV testing Labs. For example in Malware Protection tests Trend Micro got the results as follows:

------------------- 2019----2020
AV-Comparatives.............0............257
AV-Test....................................0..............0

Norton got stellar protection results in any test, because it adopted in default settings a file reputation lookup (Norton Insight feature). This also caused the biggest false positives rate. Similar settings are available by tweaking Kaspersky (unknown ---> untrusted), Avast (Hardened Mode), or Microsoft Defender (ASR prevalence rule). In fact, a tweaked Kaspersky can apply stronger protection than a tweaked Norton.

Links to tests:
SE Labs
News Archive - AV-Comparatives (av-comparatives.org)
Home users (av-test.org)

 

[Back3]

Maybe F-Secure Safe is the only antivirus that cannot be tweaked!

 

[Andy Ful]

Maybe F-Secure Safe is the only antivirus that cannot be tweaked!

Norton's antivirus features too, in a great deal (but you can turn off some features).

 

[FireHammer]

Where is Bitdefender?

 

[MacDefender]

Norton's antivirus features too, in a great deal (but you can turn off some features).

It's been about a year since I've looked at Norton 360, but it seemed to let you set heuristics aggressiveness in a few different ways. Not as tweakable as Symantec which gives you something like 10 levels of SONAR protection, but yeah, F-Secure just has some big on/off switches for realtime and behavior blocking. Other than that, just a extensions filter and option to scan archives on-demand or not.

 

[Andy Ful]

Anyway, there are more differences:

AV-Test Malware Protection 2019-2020 missed samples from 182296 total samples.
--------------------------2019---2020
Avast Free............56......0
Avira Pro...............5......21
F-Secure Safe.......2......0
Kaspersky IS........2......0
McAfee TP............0......0
Microsoft.............7......0
Norton 360..........0......0
TrendMicro IS......0......0


AV-Comparatives Malware Protection 2019-2020 missed samples from 41877 total samples.
------------------------2019--2020----------
Avast Free............1.......2
Avira Pro..............4.......7
F-Secure Safe.....23......1
Kaspersky IS.......22.....4
McAfee TP..........30......7
Microsoft.............6......12
Norton 360..........2.......2
Trend Micro IS.....0......257

 

[Andy Ful]

Other differences between AV Labs (except maybe Avast scorings) can be explained by a too-small number of samples. Such differences are visible also for AV-Comparatives by comparing two years:

AV-Comparatives Malware Protection 2019-2020 missed samples from 41877 total samples.
------------------------2019--2020----------
Avast Free............1.......2
Avira Pro..............4.......7
F-Secure Safe.....23......1
Kaspersky IS.......22.....4
McAfee TP..........30......7
Microsoft.............6......12
Norton 360..........2.......2
Trend Micro IS.....0......257

 

[Andy Ful]

Where is Bitdefender?

I included only the AVs that participated in all tests - Bitdefender did not.

 

[FireHammer]

I still thinks Bitdefender/Kaspersky is the 2 best AV`s out there, And I am staying with Bitdefender because I have not had any Virus on my system since I installed it 5 years ago, and it has saved my but a few times, and reason 3 is compatibility with the hardware/software on my Notebook

 

[nico_be_rocky]

my experience was this: after years and years of using kaspersky, which I still find excellent, I switched to trendmicro after trying beta and realizing that it did not block some business programs, print servers etc that kaspersky instead blocked and where the assistance failed miserably to make it work properly.
this was a kaspersky issue, but I noticed how different products that have their own firewall, unlike trendmicro, kept interfering and being a little too intrusive in the web part.
unexpectedly I also found the system lighter despite the increased ram consumption. the fact that you consume a few mb more does not mean that it is heavier, on the contrary, everything worked better in daily use.
kaspersky slowed down thunderbird a lot, it was effective, found fraudulent emails, but also blocked those that were not. in short... trendmicro for me had the highest value for money. I don't do a lot of scans, I think the most important thing nowadays is proactive protection and phishing protection.
I just use fast scheduled scans once a week and a full one a month just because I handle a lot of documents and emails. we talk about tens and tens of thousands per month, entering a lot of usb, receiving emails etc... the scans anyway on ssd are very quick. the fact that it is not very configurable does not cause me problems since apparently it is already very well configured and proof of "my mistakes"

 

[SeriousHoax]

After malware submission, it takes them 2-3 days sometimes to add a detection.

There's a simple trick to make them add signatures quickly. Use this business page to submit samples to them. They even give you a reply if you do so. In my experience so far, they respond in less than 6 hours that the sample is indeed a malware and a detection will be added soon. The detection is then added within a few hours after that reply.
Automatic sample submission uploader (bitdefender.com)

 

[Andy Ful]

"The malware protection test includes old, inactive malware, which for better pattern maintenance, ...
...

This part of the Trend Micro explanation is questionable. From the AV-Comparatives report September 2020:

"Testcases
The test set used for this test consisted of 10,102 malware samples, assembled after consulting telemetry data with the aim of including recent, prevalent samples that are endangering users in the field. Malware variants were clustered, in order to build a more representative test-set (i.e. to avoid over-representation of the very same malware in the set). The sample collection process was stopped end of August 2020."

Such samples can survive on flash drives, network drives, inside repositories downloaded via torrents, ISO images, etc. I would rather believe AV-Comparatives that these samples can be still dangerous for some people. The Trend Micro answer is not convincing, especially when other vendors can detect such samples far better.
Malware Protection Test September 2020 - AV-Comparatives (av-comparatives.org)

Generally, I agree that for many people it is better to get top Real-World protection and not-especially-good Malware Protection (but almost 0 false positives) than conversely.

 

[Andy Ful]

my experience was this: after years and years of using kaspersky, which I still find excellent, I switched to trendmicro after trying beta and realizing that it did not block some business programs, print servers etc that kaspersky instead blocked and where the assistance failed miserably to make it work properly.
this was a kaspersky issue, but I noticed how different products that have their own firewall, unlike trendmicro, kept interfering and being a little too intrusive in the web part.
unexpectedly I also found the system lighter despite the increased ram consumption. the fact that you consume a few mb more does not mean that it is heavier, on the contrary, everything worked better in daily use.
kaspersky slowed down thunderbird a lot, it was effective, found fraudulent emails, but also blocked those that were not. in short... trendmicro for me had the highest value for money. I don't do a lot of scans, I think the most important thing nowadays is proactive protection and phishing protection.
I just use fast scheduled scans once a week and a full one a month just because I handle a lot of documents and emails. we talk about tens and tens of thousands per month, entering a lot of usb, receiving emails etc... the scans anyway on ssd are very quick. the fact that it is not very configurable does not cause me problems since apparently it is already very well configured and proof of "my mistakes"

The protection difference between most of the good AVs is not visible in wide-spread attacks. So, the user can simply choose the AV he/she likes best.

 

[Andy Ful]

The sum of missed samples in Malware Protection tests for all AVs listed in my OP except Trend Micro:
AV-Test ---> 93
AV-Comparatives ---> 123

Despite the similar numbers of missed samples, AV-Comparatives tested only about 42000 samples and AV-Test tested about 182000 samples (over four times more). So, the samples tested in AV-Comparatives are probably fresher than in AV-Test. From the AV-Test report we can read:
"Detection of widespread and prevalent malware discovered in the last 4 weeks (the AV-TEST reference set)".

So, for both AV-Comparatives and AV-Test, the samples in the Malware Protection tests are gathered from about one month. By the way, Trend Micro missed more samples than all AVs listed in my OP (257 vs. 93+123).
The horrible detection happened not in one test but in two consecutive tests (= all AV-Comparatives Malware Protection tests in 2020). Still, the opposite happened in AV-Test Malware Protection tests (0 missed samples).

 

[Andy Ful]

Because the AVs share signatures, it is improbable that Trend Micro could miss so many one-month-old samples.
My guess is that the difference between AV-Comparatives and AV-Test follows not from old but rather one-week-old samples (medium old samples in Malware Protection tests). These missed samples were probably blocked in the wild as fresh samples by Trend Micro's prevalence or reputation rules, but Trend Micro did not make detailed analysis in the cloud (other good AVs do it). So, contrary to Trend Micro, other AVs could already have the signatures for such threats and scored well in the AV-Comparetives Malware Protection tests.

Edit.
The samples from Malware Protection tests have several times smaller infection rate as compared to fresh samples. So for most users, the overall protection of Trend Micro is probably similar to Kaspersky and F-Secure.

 

[Andrezj]

Maybe F-Secure Safe is the only antivirus that cannot be tweaked!

programming the user risk out of the software, the user has almost no decisions to make
for security, it is better to educate the user and teach them how to use hard security options
for human nature, skip the security, instead give the user a few games with some high sugar and fat-content beverages and foodstufs