This posting will discuss which of the following three programs deserves the title of “best freeware antivirus program”: Avira Antivir, Avast, or AVG. My conclusion: all three are very worthy contenders that can hold their own or surpass any heavyweight for-pay antivirus; however Anitvir and Avast are definitely in the first tier, while AVG is a close second tier.

There’s been a vigorous debate going on in the little “cbox” message box (in the sidebar) over which freeware antivirus program is best. This posting will explore this issue more closely. The objective is to go beyond the ubiquitous “I have used program x for y years now and it has kept me completely virus free” to a more substantial comparison.

The findings presented here are not my original work but come from a single source: AV-comparative.org’s antivirus comparison tests conduced in Nov 2008 (test #20) and Feb 2009 (test #21), which are the latest as of this writing. It is somewhat difficult to reference these as sources because the av-comparatives site disallows direct linking to the test results and requests that all links be to its root domain (presumably because new tests are always published and they do not want links to results that may be obsolete).

By way of comparison and to provide some perspective I will also include some of the numbers for two of the best paid antivirus programs: Kaspersky and ESET NOD32.

Where AVG has a good advantage is in the number of false positives (lower than both Antivir and Avast, both of which exhibit comparable numbers of false positives). However, AVG scores another strike against it in terms of its scanning speed, which is significantly slower than the other two.

The freeware version of Antivir displays an advertisement on every update, which is rather undesirable; however, this can be easily disabled (look here, here, or here). It also “does not support email scanning”; however, this is also a non-issue in my opinion, a red-herring designed to scare less tech-savvy users into purchasing the paid version. The reason I say this is a non-issue is because although Antivir may not scan your email for virus as it downloads, it will still protect you from it afterwards, not just during normal scans as it will also intercept it once it is on-disk and/or if and when it tries to act up.  In fact email scanning as such may be completely redundant and a waste of time; see this article for more info.

Antivir is my favorite freeware antivirus. It is best in terms of performance and, with the recent addition of an antispyware component it has become even more desirable. However, if asked to recommend a freeware antivirus Antivir comes with too many caveats and explanations (the nag screen, the email scanning (non)issue). It is easier to recommend Avast, as it provides comparable protection and performance, and is an excellent product.

AVG is my third choice. It also provides excellent protection and has the edge with respect to the least number of false positives, but its performance and detection rates lag behind the other two.

The numbers (and other issues considered):

1. Detection Rate / on-demand scans
2. Detecton Rate / predictive “heuristic” detection
3. Number of false positives
4. On-demand scanning speed
5. Versions tested
6. Links and downloads

• Avira Antivir: 99.7% detection rate
• Avast: 98.2%
• AVG: 93.0%
• Kaspersky (*): 97.1%
• ESET NOD32 (*): 97.6%

* Note: no free version of these offered. They are listed here to give ’perspective’.

The data seems to show that overall the detection rates are very similar (the differences are unlikely to be meaningful), with the exception of AVG which has a somewhat lower rate of detection than the others.

• Avira Antivir: 71% (over 1 week), 67% (over 4 weeks)
• Avast: 40% (over 1 week), 39% (over 4 weeks)
• AVG: 43% (over 1 week), 40% (over 4 weeks)
• Kaspersky(*): 71% (over 1 week), 60% (over 4 weeks)
• ESET NOD32(*): 54% (over 1 week), 51% (over 4 weeks)

The results above seem to show that when handling yet unknown threats (malicious code that is so brand new that it has not been added to the program’s database), Antivir and Kaspersky have an advantage over the others.

• Avira Antivir: 24
• Avast: 28
• AVG: 17
• Kaspersky (*): 14
• ESET NOD32 (*): 13

Interestingly, Avast and Antivir have significantly higher false positives than the two paid programs, with AVG having the lowest number of false positives of all three freeware antivirus programs.

• Avira Antivir: 13.6 MB/sec
• Avast: 15.4 MB/sec
• AVG: 6.8 MB/sec
• Kaspersky (*): 13.3 MB/sec
• ESET NOD32 (*): 13.2 MB/sec

On this metric AVG significantly lags behind the others, who are otherwise very similar, with Avast having a slight overall advantage.

• Avira Antivir: 8.2.0.374 (test 21), 8.1.0.362 (test 20)
• Avast: 4.8.1335 (test 21), 4.8.1229 (test 20)
• AVG: 8.0.234 (test 21),  8.0.156 (test 20)
• Kaspersky (*): 8.0.0.506a (test 21), 8.0.0.454 (test 20)
• ESET NOD32 (*): 3.0.684.0 (test 21), 3.0.669.0 (test 20)

• Avira Antivir free: see my Mar 2007 review of Antivir here.
• Avast free: free registration required
• AVG free

  .

Virustotal

Let’s assume for the sake of discussion that most of us have fairly competent, updated virus-killer and antispyware software and firewalls that keep malware attacks at bay. But what if you want to open a file or run an .exe that is, by your estimation, of dubious origin? It is possible for you to manually override your antispyware and firewalls merely because you are accustomed to doing so when they intercept legitimate software and files and ask for your arbitration. Or, alternately, you might have a dangerous file that is simply not being recognized as such for whatever reason by the security software you are using.

This issue is of particular concern to me as I like to think that all the software featured on Freewaregenius is malware free, and the way I "check" for this is to simply try out the software and see how the security software I run responds, which is not really a guarantee that a file is malware free.

Enter Virustotal, a service that will scan any file that you upload to it using more than 30 virus detection engines with all the latest updates, making it far more likely that if the file in question is dubious that it will be recognized as such by a subset of these engines at the very least. Here are more notes on this service:

• Types of malware detected: can detect worms, trojans, and all kinds of malware detected by antivirus engines. This does note include adware (I tested with a known adware program), but most (not all) of the engines will identify spyware.
• How to upload a file: simply upload using the form on the site or email to scan[at]virustotal.com with "Scan" as subject and the file included as an attachement. Another option is to use the downloadable "VirusTotal Uploader" (see screenshot) which can upload straight from the Windows context menu. Your file in all cases can be up to 10 megs in size maximum.
• The scanning process: once uploaded your file will likely be entered into a queue before it is processed, but in my experience that takes less than a minute to clear. If the file has been uploaded to VirusTotal previously you are given the option to see the report that is on file or to re-scan. Virustotal will scan your file sequentially in one virus engine after another and display the results as they become available. Typically this entire process takes less than 5 minutes, but there are high-load instances where it could take up to 15 minutes+.
• Engines supported: include Kaspersky, NOD32, Avira, and AVG. For a complete list go here.
• How to read the results: is up to you. check out the latest AV-Comparative tests to figure out which virus killer engines are the most effective, and of course the more warnings your file generates the more concerned you should be. What’s cool is that even when you have one or two warnings they are usually spelled out in a way that can shed some light on what the potential issue may be. See the screenshot above for an example of results.
• Statistics: some interesting numbers in the stats page.

Overall this is a fantastic service that delivers the collective wisdom of the malware-fighting community to your fingertips on demand. Note, however that this is not a substitute for having an antivirus program with real-time protection locally on your machine. For someone like myself who might need to know exactly what software I am publicizing/recommending to my readers on my site this simply is an amazing resource.

Go to the Virustotal page.

Version tested: 1.1.0.42

[Note: this review was written by my friend Mohammed Raei from Amman, Jordan; see his personal blog here - The Freewaregenius]

AVG Anti-Rootkit Free is a program that scans your computer for rootkits and removes them.

Trojans, keyloggers, and worms can sometimes hide from conventional Anti-virus software inside "rootkits", rendering them useless in the face of such threats. This is where AVG Anti-Rootkit Free comes in. This is a very small and fast program that you should run before you do a virus scan, because virus killers do not detect or protect from rootkits. Once you ensure that your computer is free from rootkits your antivirus software can take it from there and prevent the installation of future rootkits.

I was able to run a standard scan in under 4 min and an in depth scan in about 14 min on my 5 years old Athlon XP 2000. I was not able to find any rootkits on my system, so I cannot comment too much on its efficacy. Suffice it to say that I now feel much more confident that my computer is free of rootkits than I was before.

This program lacks any sort of scheduler because in theory, you only need to run it once. That being said, it would not hurt to run it every once in a while. Make sure to manually update the program first as it does not auto-update.

Compatibility: Windows 2000, XP

Go to the program page to get the latest version (approx 120K). Also visit the program home page.

Antivir Personal Edition Classic is a free, award-winning antivirus software. It provides scanning on demand as well as real-time protection against a wide array of malware including viruses, trojans, worms, and dialers. Antivir also offers excellent heuristic virus detection (i.e. its ability to identify yet-unknown threats). 

Version tested: 7.00.03.02

This review was borne out of an email exchange with Freewaregenius reader Sinkhan, whose emails I quote below with permission. For a comparison of the best freeware antivirus programs see my article: The best free antivirus: a comparison (where, incidentally, Antivir came out on top).

Sinkhan: “I feel that there is some freeware that should definitely belong on your site. First of all, in your top ten picks, you list Grisoft’s AVG as your third favorite pick…. I would like to bring up AntiVir from Avira. This program is very near and dear to my heart. Although I’ve tried AVG and a close competitor that you may have heard of, Awil’s Avast!, Avira’s AntiVir Personal Edition Classic is a free program with an outstanding performance record.

At www.av-comparatives.org, an independant organization that researches anti-malware software, recent tests show that AntiVir has stellar detection rates, beating other commercial giants like Norton, McAffee, and quite substantially beating Avast! and AVG. The tests conducted were yes, done on the paid versions, but according to this part of Avira’s site, both the free and paid versions use the same engine for detecting viruses. The only features that the free version may lack is *fully* automatic updating (which however can be configured in the program to be automatic) and e-mail scanning (which I find rather unnecessary when using web-based email such as Yahoo!, G-Mail, or Hotmail).”

Me: “Thank you for your email. Indeed you’re right, there’s a lot of titles missing from my site. This is primarily a function of time, but I will say something about some of the titles you mentioned… I simply stayed away from [Antivir] because of the email scanning issue; for work, I have to use a POP3 account and I simply cannot have that vulnerability. But for anyone who only uses web services (Gmail, Hotmail) like yourself I agree it might well be the antivirus of choice.”

Sinkhan: “I still encourage you to use AntiVir at home if you can’t at work (Despite my incessant effort to try and encourage as many people to use AntiVir, I don’t work for them, of course, I wish I did. I’m just a huge supporter.) Of course, there are probably several robust freeware programs out there that could compliment AntiVir in its work. One would have to admit that the results from av-comparatives are rather conclusive.”

Me: “I’m going to install AntiVir on my home computer to test it out. I was very impressed with the results for this program on AVcomparatives.”

Sinkhan: “It’s great to see that I’ve convinced you to try out AntiVir. I’m confident that you’ll be satisfied”.
—

After a few days of using Antivir on my home computer I installed it alongside AVG on my work computer as well. Here are some noteworthy observations:

• According to the tests conducted by www.av-comparatives.org (Feb 2007), Avira’s on-demand scanning outperforms not just AVG and Avast but for-pay heavyweights such as Kaspersky, NOD32, McAfee and Norton. Note that av-comparatives ask that these results are not reproduced or linked to directly (?), but you can easily find them from the main page.
• The test for pro-active detection of unknown viruses (conducted Nov 2006) produced similar results, with Antivir trumping all of the above mentioned programs by a wide margin (except for NOD32, which it was on par with for that test).
• Note that these tests were conducted on the commercial versions of these programs, although, as Sinkhan has pointed out, the free and paid versions of Antivir use the same detection engine.
• Updates: Antivir by default installs itself with a daily update schedule every 24hours. This means that although the free version will not update itself at each and every point that an update is made available, it will update itself every day at a set time. No need to worry about updating manually.
• Antivir is a well designed, slick-looking program that does not seem to hog the computer’s resources.
• Nag screen: please note that whenver the free version of Antivir installs new updates, a browser window appears with a nag screen urging upgrading to the paid version. This nag screen can be removed by following the instructions here, here, or here.
• Email scanning: although the free version of Antivir does NOT offer real-time email virus scanning and detection; it is not clear, however, that this makes it any less effective with threats that might make their way to the hard drive via email, as it will protect you from these threats anyway after they are downloaded (see this article and this article for more in support of this position).

The Verdict: This is one of the best antivirus programs out there and probably the most powerful free antivirus option. If you only use web mail (Gmail, Yahoo, Hotmail, etc) then this definitely should be your free antivirus of choice. If you use regular downloadable email you can still use this provided you install another antivirus program that can do email scanning for you. I recommend AVG to do this, as it has a light footprint and co-exists well with other antivirus programs. To lower these program’s claims on your computer’s resources, simply de-activate all of AVG’s services except the update manager and email scanner.

Compatibility: Windows 98/ME (only supported until 30.06.2007), NT (only supported until 31.03.2007), 2000/XP, Vista.

Go to the download page to get the latest version (approx 13.7megs). Also visit the program home page.

Rating: 5 

Version tested:  7.5.430

Although AVG is well known as a free antivirus program, I wanted to review it because the new version 7.5 (Oct 2006) seems to offer better protection than its predecessors

First, the good news:

• AVG is a complete antivirus solution that features dependable real time protection as well on-demand virus scanning
• AVG features auto updates, making it a good install-and-forget solution that you do not have to manually keep updating (some other ‘free’ antivirus programs will force you to keep doing this in order to incentivize you to buy the paid version).
• AVG has a remarkably small footprint, is light on memory use, and generally will not hog your system resources. Upon replacing Norton AV with AVG I noticed that my system boot time was three times faster and my system in general was noticeably more responsive, especially the time it took to acess files. If you suspect that your antivirus software is making everything unaccpetably sluggish then I recommend that you experiment with removing it and installing AVG.
• AVG provides email virus protection for both incoming and outgoing emails. This is not to be taken for granted, since it is the one reason why AVG is my choice over Antivir, another excellent free antivirus which is excellent for both real time and on demand scanning but somehow does not offer email scanning. Given that I receive 100+ spam emails a day on one of my POP3 email accounts, this feature is really important to me.
• Its Windows Vista ready

Second, the not-so-good news

• Although AVG is very good at detecting known virusus, it’s so-called heuristic detection abilities have been somewhat lacking. Heuristic detection is a protection against viruses that are yet unknown based on observing the patterns of behavior of legitimate code vs. viruses (it is a kind of ‘generic’ virus protection). According to the Grisoft website, however, the new AVG upgrade to ver. 7.5 promises “improved virus detection based on better heuristics and NTFS data streams scanning”. All of the antivirus software comparisons that I could find tested older versions however, so until new comparison test are published it is not clear just how much this has improved. But the improvement seems to be significant, since the Grisoft website states that “recent certifications include VB100%, ICSA, and West Coast Labs Checkmark”. The West Coast Labs certification in particular is something that AVG previously lacked while AVAST, another free antivirus soft, had.
• The free version of AVG is stripped of the spyware/adware detection component of the paid version. You could download and install this seperately, but the free version is significantly handicapped. This is not a huge concern, since there are many freeware antispyware programs that you could install seperately that offer excellent protection. Click here for reviews of some of these on FreewareGenius.
• From what I’ve read AVG has been associated with a high rate of false positives. I’m not sure if this is still the case, but I do know that this has not been an issue in my experience.
• Predictably, there is no technical support offered to users of the free edition. If you feel that this is something you need then its probably worth it to buy the paid ‘pro’ version.

The verdict:

AVG is a program that keeps getting better and better, and manages to do so without growing into a resource intensive monster that takes over your machine. I’ve looked at many antivirus comparisons, and it seemed like the more recently the test was conducted the the better AVG performed.

I am very comfortable recommending AVG as your primary virus protection software, provided you (a) have adequate seperate protection against spyware/malware, and (b) you have a good firewall running. Currently on my machine I am running a combination of AVG antivirus, Spyware Terminator, Spyware Blaster, and Comodo Free Firewall, and I haven’t experienced any problems despite the fact that I am constantly downloading/installing and testing out all manner of files/programs on my machine, including some that may be somewhat dubious.

Go to Program Download Page for the latest version. The Program home page.

Comodo promises to be a complete install-and-forget antivirus solution that it 100% free.  This is beta software, so before you install and use this software please read the rest of this posting.

Rating: 5 

This post last updated: Nov 7, 2006

Version: 1.1beta

I have been using this software for a while now and I must say I am satisfied with it, so far it seems to be delivering what it promises. However, I will say that this software is in beta and this sometimes shows in the form of unexplained crashes and quirky behavior.

This program feautures (a) real time protection, (b) incoming/outgoing email scan, (c) automatic updates, (d) virus scans on demand, and (e) it also promises powerful heuristic detection of unknown viruses (i.e. a type of smart detection whereby an unknown virus is identified based on its behavior).

Comodo also does not seem to require a lot of resources to run. This is good, as my biggest peeve about many antivirus programs is that they can be so resource intensive as to literally slow up a fairly decent spec machine (Norton and McAfee spring to mind). Happily, from both what I read as well as well as my experience so far, this software does NOT seem to be a resouce hog.

But I do have a number of complaints about this program, all related to the fact that this software is still a beta release.

For example, I have experienced a number of crashes upon downloading updates and have been unable to download email because Comodo seemed to be ’stuck’ in the process of scanning email. Also, on some (but not all) PCs I’ve installed this on I’ve noticed that there is an issue whereby Comodo is notrecognized by Windows Security center as an Antivirus program, and I really do not like to be stuck with an icon notification in the tray area asking me to install an Antivirus program. (Note: the Comodo support forums have confirmed that the Security Center issue will be addressed in the upcoming ver 2beta. Until then, you could simply live with it or go to Security Center and check the box that says “I have an antivirus solution that I will monitor myself”).

The other thing I don’t like about CAV is that the version I tested would not work with another antivirus program installed (in fact, my system would not boot at all and I had to go to safe mode to remove both of them and reinstall CAV). While having only one antivirus software might make sense in terms of resource utilization, etc, there are times when you would like to have two sources of protection for a layered defence.

Finally, despite the exciting things that this program offers, we will have to wait until the official release in the beginning of 2007, when the software will be submitted for comparison testing, in order to learn more about how it fares in relation to other antivirus programs.

Note: it seems that Comodo have had problems in the past that have given them a bit of a bad rap. Their software used to install a component to promote their other software that was impossible to uninstall, but this has been since removed. They were also having problems with some bug issues that largely seem to have been taking care of.

All in all I am expecting this program to be a major heavyweight contender to the title of “best free antivirus”, but we will have to wait and see. I am giving it the benefit of the doubt for now with a 5-star rating, keeping my fingers crossed that the non-beta will deliver what is promised.

More detailed feature list list from the Comodo Website | Comparison table from the Comodo Website

Download page here for latest version (you will need to sign up for your free registration code). The Developer’s Site.