Microsoft Security Essentials vs Avira vs avast! vs AVG: Best free anti-virus/anti-malware program for Windows [3rd Edition]
December 18, 2011 402
Email article | Print article 
Without a doubt one of the most popular questions I am asked is “which security software should I use for my computer?” Often times the person asking me the question is looking for a free security solution as opposed to a paid one. To address this question, I have already created a post on best security software. However, now – in this article – I am going to directly address the issue of “should I use Avira, avast!, or AVG?” Of course there are many other free anti-virus/anti-malware software. However, I feel these three are the most popular and most commonly inquired about, hence why I picked them.
Update on December 3, 2010: Because of its growing popularity, and requests made to me by many people, Microsoft Security Essentials is now included in this comparison.
When evaluating security software and trying to decide which one you want to use, there are two main areas which you should look at: Features and performance. So, lets get started.
This review is part of our Best Free Windows Software section. Check out more articles on the best free Windows programs from here.
Table of Contents
Summary of Update
Features Comparison
Performance Comparison
Detection Rates
Malware Removal Effectiveness
Computer Impact
In the 3rd edition of dotTech’s guide on Best Free Windows Anti-Virus/Anti-Malware the following changes have been made:
- Features Comparisonsection has been updated to reflect new features added to Avira Free, avast! Free, AVG Free, and Microsoft Security Essentials since the 2nd edition of this article was written. All four made tweaks and modifications to their existing features; the major new features are:
- Avira Free – “WebGuard”
- avast! Free – Behavior blocker, “Auto Sandbox”, “Script Shield”, “WebRep”
- AVG Free – Largely unchanged
- Microsoft Security Essentials – Behavior blocker, “Network Inspection System”
- Performance Comparison section has been updated to reflect new on-demand and retrospective detection rates for Avira Free, avast! Free, and Microsoft Security Essentials. AVG Free did not participate in the latest retrospective tests so AVG Free’s detection rates have been updated only for on-demand tests.
- Performance Comparison’s sub-section Speed and Computer Usage has been rewritten with a new source and renamed to Computer Impact.
- Performance Comparison now includes a new sub-section, Malware Removal Effectiveness.
(Click on the chart to view it in full size.)
In terms of features, as you can see in the chart above, all four programs provide the necessary fundamental protection. However, it is worth noting that neither of the programs provide full/advanced phishing protection; you will have to cough up money for paid versions to get full/advanced phishing protection. Or, you could just be careful about what links you click; and double-check to make sure the website you are at is who it claims to be since phishing success heavily depends on social engineering and user ambivalence.
Furthermore, while all four programs provide the fundamentals, avast! is the most notable one for going “above and beyond” the basics and providing a little extra bang for the buck (or lack thereof). In other words, avast! provides more “extra” features than the other three, although AVG Free also has some nice extras. It also should be noted Avira Free’s “WebGuard” requires users to install Avira Toolbar, which is powered by Ask.com; and Microsoft Security Essentials has an interesting feature called “Network Inspection System” — a guard against network-based exploits.
Lastly, even though Microsoft Security Essentials is the only one to not prompt users with advertisements it must be noted that the ads in avast! Free are non-intrusive and embedded within the main console window – they are not the popup ads Avira Free is notorious for and AVG Free sometimes displays.
(Click on the chart to view it in full size.)
(Click on the chart to view it in full size.)
When viewing the above test results, keep a few things in mind:
- The On-Demand Anti-Malware Tests are tests done on the security software with all their features enabled (with all settings set to the highest possible). The Retrospective/Proactive Anti-Malware Tests are tests done specifically on the security softwares’ heuristics capabilities; their capabilities to protect against unknown/new malware that have no signatures. It needs to be mentioned that heuristics is not the only feature that security software use against unknown/new malware. Other feature, such as behavior blocking, also help detect unknown/new malware; however only the heuristics feature (and no other features, such as behavior blocking) was tested in the Retrospective/Proactive Anti-Malware Tests.
- For the The On-Demand Anti-Malware Tests
- Microsoft Security Essentials had “very few” false positives; Avira had “few” false positives; avast! had “few” false positives; and AVG had “many” false positives.
- Avira scanned at “fast” speed; avast! scanned at “fast” speed; AVG scanned at “average” speed; and Microsoft Security Essentials scanned at “slow” speed.
- The tests were conducted 1-5 months ago. In other words, Avira, avast!, AVG, and MSE (Microsoft Security Essentials) may have improved (or degraded) their performance since these tests were conducted. These are the versions of each program used for both of the above tests:
- The tests were conducted using the free version of Avira (“Avira AntiVir Personal” is another name for Avira Free); free and paid version of AVG, respectively for each test; and free version of avast!. Microsoft Security Essentials, of course, is free by definition.
Because of the above mentioned points,
- The performance of each software today may be different than when the tests were conducted.
- The performance of the free edition AVG may perform slightly differ than what is shown above since paid version for AVG was used for one test.
However, keeping that in mind, for the purposes of a simple comparison these test results work just fine because they give general indications, which is what we are looking for.
That being said, the results are a clear indication of Avira’s detection superiority. Not only does Avira have the highest on-demand detection rates, but it also tops the chart for retrospective tests; all with fast scanning and few false positives. avast! comes in a close second with healthy on-demand and retrospective rates, fast scanning, and few false positives. MSE is fourth in on-demand detection but does very well in retrospective tests and comes out on top when it comes to false positives. (It should be noted MSE’s lower on-demand rates help it do better in terms of false positives: It detects less so there is less chance of it to have false positives.) AVG, in my opinion, is the most disappointing of the lot. It doesn’t do too badly in on-demand but does terrible for retrospective and has many false positives.
Based off just these test results, Avira and avast! are definitely my two top picks, with MSE a close third. However, the tests were conducted in a lab setting for benchmark purposes. In other words, they don’t exactly reflect “real life”. In real-life usage the protection between all four program will be similar because most user activity will fall within areas covered by all four. I may be a bit bold when I say this but the differences between all four software will typically only be felt when conducting benchmarks or tests.
(Click on the chart to view it in full size.)
Being able to detect malware has value in of itself; simply knowing you are infected is worthwhile. However, an anti-virus/anti-malware program that cannot remove malware is probably one you don’t want to have. Hence in the 3rd edition of dotTech’s guide on Best Free Windows Anti-Virus/Anti-Malware we look at the results of a malware removal effectiveness test.
Before we discuss the results it must be noted this malware removal effectiveness test had limited scope — it only used ten samples. It is hard, and frankly not fair or logical, to draw authoritative conclusions based on a test that only used ten samples. However, for the purposes of a non-authoritative indicator, this test will do just fine… as long as you keep in mind the limited scope.
That said, Avira once again tops the charts. MSE comes in a close second with AVG and avast! lagging as distant third and fourth, respectively. As I said, this test used only ten samples so we can’t say avast! or AVG are incompetent at removing malware while Avira or MSE are the best. The results very well could have been different if different ten malware samples were picked. (That is why having a large, randomized sample size is important in any test.) However, I believe it is fair to say with its combined stellar performance on-demand and retrospective detection rates and malware removal effectiveness, Avira more than makes up in performance what it lacks in features.
(Click on the chart to view it in full size.)
(Click on the chart to view it in full size.)
(Click on the chart to view it in full size.)
NOTE: Avira Free 2012, avast! Free v6, AVG AntiVirus 2012, and Microsoft Security Essentials v2.1 were used for the above tests.
Generally speaking, the computer impact of all four software is about the same. True, avast! does come out on top but only by a small margin; and this small margin will only be noticed when benchmarking — not in real-life usage. Really the only test worth noting is opening Word and opening PDF. In this test avast! out shines the other three on the first run (subsequent run they all perform the same). All other aspects of the Computer Impact test end up with results that are too close to draw lines between.
(For those that don’t know, PC Mark is a professional, industry-recognized benchmarking tool. The higher PC Mark score, the better. However, when it comes to PC Mark, few points here and there have no significant meaning. If PC Mark scores were drastically different, such as 50 or more, then it would be worth looking at.)
Note: All tests referenced in all Performance Comparison sub-sections of this article were not conducted by dotTech. They (the tests) were conducted by AV-Comparatives.org, an authority on security software testing. I attained permission to re-publish AV-Comparatives’ results on dotTech when I originally wrote this article.
While there are some noteworthy aspects – such as Microsoft Security Essential’s low false positive count or avast!’s lowest computer impact or Avira’s best detection and removal performance – there is no one “winner” between Microsoft Security Essentials, Avira Free, avast! Free, and AVG Free. To try to determine which one is the “best” is like trying to split hairs; it is hard to do and it hurts. In real-life situations, all four programs will provide users with excellent protection.
However, with that being said, if I were to rank these four I would rank Avira and avast! as my top two picks; Avira for its detection and malware removal and avast! for its features and lowest computer impact. Microsoft Security Essentials and AVG come after Avira and avast!, with each providing one or two unique features that have potential to win over users.
Now, what program you should use comes down to your specific needs and desires. Want the most features? avast! Free is the way to go. Are you looking for the best detection rates and don’t care about anything else? Avira Free is for you. Want a simple anti-malware program that provides great protection without nagging ads? Microsoft Security Essentials beckons you. Worried about network security? Microsoft Security Essentials’ “Network Inspection System” may serve you well. Are you a social network addict? Go with AVG Free for it has “Social Network Protection”. Hate false positives? Avoid AVG and consider Microsoft Security Essentials. Dislike slow scan times? Don’t get Microsoft Security Essentials. Surf the web a lot, besides your frequent websites? avast! Free’s “Web Shield” provides better specialized protection in that area than the other three programs. Download lots of software? avast! Free’s “Auto Sandbox” may be your next best friend.
I have provided you with the facts; now the choice of Microsoft Security Essentials, Avira Free, avast! Free, or AVG free is in your hands. Whichever one you pick, rest assured all four will serve you well.
Avira Free AntiVirus
Supported OS: Windows 2000+
Avira AntiVir Personal homepage [download link]
avast! Free Antivirus
Supported OS: Windows XP+
avast! Free Antivirus homepage [download link]
AVG Anti-Virus Free Edition
Supported OS: Windows 2000+
AVG Anti-Virus Free Edition homepage [download link]
Microsoft Security Essentials
Supported OS: Windows XP and higher
Microsoft Security Essentials homepage
Originally written on February 14, 2010. 2nd edition posted on December 3, 2010. 3rd edition posted on December 18, 2011.
![Why I switched from Avast to Avira: better computer performance and speed [Opinion]](http://cdn.dottech.org/media/2013/03/speed-134x90.jpg)
![[Android] Avira Free Android Security helps locate your lost device, remotely lock and wipe data, block unwanted SMS and calls, and more](http://cdn.dottech.org/media/2013/01/unnamed-41-134x90.jpg)
@Bill3 – Good day to you! Wow!
Would be grateful if you could share the following so we could learn from you:-
1)I quote you – “Comodo Internet Security that has real time, and registry monitoring, so you have to be savvy enough to answer awkward questions”. Could you share some tips please.
2)I quote you – “You need to disable some of 1 to 14 from running on start up with your start up manager”. Is the mere act of removing some of them from running at startup adequate to prevent software clash? I thought that it would not be because these apps reside on the RAM due to which just removing them from startup is not sufficient – after all they would still run parallelly in realtime wouldn’t they & clash because of that. Or are there additional configuring tweaks as well, apart from disabling from running at startup?
3)I quote you – “Also, you need to be very savvy, in dealing with the results, or you could easily wreck your system”. Assuming “wishfully” for a moment that there are not too many “types of results” could you share your experience & insights please.
We’d benefit from these learnings. I for one intuit there’s lots of good things I can pick up from you
Ramesh :)
Hi Ramesh Kumar,
wow, do you ask some difficult questions, that would take ages to reply to, and really are down to experience. SO I’ll just provide some pointers, and people can google the rest :
1 Comodo Internet Security that has real time, and registry monitoring, means it watches every change to the registry and your system, insisting on authorization from you to make the changes.
Example 1 : AVG.exe is trying to make changes to the registry, do you wish to treat this as an installer. Obviously, Yes.
Example 2 : Ditto with Video.exe. Obviously no, because this is an unknown download.
Example 3 : With virus alerts, just quarantine them, then google, to find out what they are, then restore them as they may just be heuristic, or remove them if they are actually defined as a virus by Mcafee or another competent security expert. This is one I dealt with last week :
W32/Obfuscated.BD!genr Google = Aliases Heuristic.LooksLike.Trojan.Chydo.J Detected by McAfee-GW-Edition
so you have to be savvy enough to answer awkward questions. —-
Example 4 Other complicated questions about the registry or happenings, are often easily answered by referring to the origination program. Open Office or JV16 would be OK, but the rest is really down to experience, which is where the novice falls down.
Example 5 Something is trying to connect to the internet, rarely do you allow this, because it is a classic spyware action.
2 You need to disable some of 1 to 14 from running on start up with your start up manager”. Is the mere act of removing some of them from running at start up adequate to prevent software clash.
Yes, use Process Explorer to check whats actually running, and this will also verify the rest of your questions about this.
3 I thought that it would not be because these apps reside on the RAM due to which just removing them from startup is not sufficient – after all they would still run parallelly in realtime wouldn’t they & clash because of that. Or are there additional configuring tweaks as well, apart from disabling from running at startup?
No. Programs reside on the hard drive, and only work if XP loads them into ram, which is a computers work place ; just as people live in their houses, and only work if they drive to their work places.
4 Also, you need to be very savvy, in dealing with the results, or you could easily wreck your system.
Experience & insights please. See examples in 1. I’m sorry I cannot advise you further Ramesh, because I’m only an amateur, with little experience, who just gets by, often with a lot of luck, and System Restore.
The above is the reason security software is simplified, and therefore, because heuristics cannot be accommodated, not so effective
Regards Bill3.
Shouldn’t this article begin as “Without a doubt”, or are you doubtful that this is indeed the most popular question you are asked? =)
I’ve been using avast for a while now and like it quite a bit. I’ve never liked AVG much, though I haven’t tried it for a couple of years. I have never tried Avira, but I’m setting up another W7 box here soon so I think I’ll try Avira out on it, I’d be curious to see the differences.
I always run my full-scans as I’m heading to bed, so I don’t really mind the time it takes. And the delta on its memory usage is so much lower, it really makes it worth it to me. I can be running 10+ development apps at a time so my memory is precious to me!!
@Thom Porter: Wow! After almost 5,000 views you are the first person to notice that and warn me about it! (At least the first person who’s warning I noticed…) Thanks – it has been fixed.
@Bill3:
Thanks a ton friend. I understood your excellent examples & have all along been practicing them :)
Examples 1 & 2 – Absolutely right. Win Patrol & Anvir Task Manager point out if some “bad boy process” is doing its thing. Example 3 – yes I quarantine that sys file in Avast 4.8 before passing verdict as to whether that process is good or bad. The finding out part I do using Glarys Utilities Pro on Google & within Glarys own database. Example 4 – jvPowerTools 2009 & WinUtilities Pro 9.41 helps me catch if a bad boy app is doing fishy things to the registry. Example 5 – I know if I have a phoner & if he is a bad boy app – “Anvir Task Manager” & “What’s My Computer Doing” tell me that.
Thanks for the Process Explorer tip. I have used it. I’ll endeavour to use it even more savvily to prevent software clash. Hey! Wait a minute; your excellent post contained a “clue” so I could figure it out. Upon checking the gui of Process Explorer 11.33 I discovered there is no option to “delay a start up”. The only option is to “suspend” or “kill” a process. Got it Bill3. You simply suspend a process. You are a great suspender (just joking) :) Bingo!.
That’s a neat trick. Using this approach one can well have more than one AV on one’s machine. QED! I intuit you are also using one other data execution prevention technique & that technique relates to the OS so it should be somewhere in Control Panel. I’ll try to figure that out.
I entirely agree catching a bad boy app using signature rather than heuristics is the better approach.
But Bill3 there is one thing you said. I just don’t agree with you on that point. “I’m only an amateur, with little experience, who just gets by, often with a lot of luck, and System Restore”. No Bill3 you are humble but not an amateur. You “get by” not because of your luck but because of your talent. Had it been the real world, I’d say “Bill3 its been a pleasure meeting you”; I am still saying it any way
Ramesh :D
@Bill3:
Hi Bill, you use a list a lot of tools there! Is this because you get regularly infected?
Do you use Sandboxie at all?
If not then I think you should, it’s free and will save you getting infected in the first place.
It’s highly regarded free tool and many would place it above any antimalware protection, in thatr it prevents you getting infected rather than protecting after you get infected, and as they say “prevention is better than cure!”
@KL: Hi KL
No I don’t get regularly infected, but I was taught and found, that there are so many nasties, that no one tool can cover them all, so by using the specialist set in 1 to 14, you get the tricky ones, and this policy has paid off many times. However, I only do my ” BIG ” scan once every 6 months, and rarely scan in between.
Thanks for the tip about Sandboxie, I only just learn’t of it in this review, so its on my ” Google to do ” list. I would be most grateful if you have any specifically good links, hot tips, etc, for me to teach myself.
Regards Bill3
@Ramesh Kumar: Hi Ramesh
Thanks very much for the compliment, much appreciated moral boost. The other trick I use is being very conservative. You sound as though your pretty well up to speed, and competent, but the following may refine things a little :-
1 In Glaries there should be a Start up manager, switch off programs there permanently from start up at boot. If not get IOBit Advanced System Care Free.
2 Most of 1 to 14 are portable apps, that don’t install, but I make a folder for them in C:\Programs anyway for good housekeeping. These don’t launch on boot.
3 There’s nothing in the Control Panel I use.
4 Google ” Services Tweak ” to Get XP running much faster.
5 Here’s a Wiki definition of heuristics, I’m still trying to understand it, so I hope it helps you :
In computer science, a heuristic is a technique designed to solve a problem that ignores whether the solution can be proven to be correct, but which usually produces a good solution or solves a simpler problem that contains or intersects with the solution of the more complex problem. Most real-time, and even some on-demand, anti-virus scanners use heuristic signatures to look for specific attributes and characteristics for detecting viruses and other forms of malware.
6 XPsyspad lets you easily find all XP’s hidden apps, if you haven’t already got it.
7 Free registry defrag is excellent.
8 Start > Run > msconfig > Enter = XP System Configuration Utility = What runs on boot up.
9 Use Process Explorer to switch as much as possible off, prior to scanning, to optimize the scan, and speed it up.
Now I would be grateful for a bit of advice :
Where did you get your funky yellow smiley faces, and how do you put them in. I got smileys from Smiley Central, but they had 37 bits of spyware in so I erased them.
Regards Bill3 from New Zealand.
@KL: Hi KL , thanks for the tip, here’s the results :-
SANBOXIE TOTAL SECURITY SIMPLIFIED FOR NOVICES
1 Sandboxie runs your applications in an isolated abstraction area called a sandbox, which is a secure area, so any nasties are contained away from your main system files. Under the supervision of Sandboxie, an application operates normally, and at full speed, but can’t effect permanent changes to your computer. Instead, the changes are effected only in the sandbox.
2 Go to http://www.sandboxie.com/index.php?HelpTopics for tutorials, etc, that are really easy to follow. Now spent a couple of hours teaching yourself.
Regards Bill3.
@Bill3
Thanks a ton! A nice start to another lovely day!
1)Thanks. I always practice a “pruned down startup” in Glarys. I also double check if it remains disabled in all other system optimizer apps too. On rare occasions I found that disablement was not automatic across apps. But then if software was a person it would be an eccentric genius – genius most of the time; eccentric aka temperamental occasionally :) isn’t it?
2)Wow! Yes using mostly portable apps in this given context is very smart since it won’t affect registry. Like you I too create folders elsewhere on the hard disk rather than using “user log” within “C My Programs”. I choose to use My Programs & My documents minimally because both are on C Drive aka system drive. If C drive crashes that would make me vulnerable to it. Therefore I park the goodies box (installers not exe) elsewhere i.e. on another Drive
3)Thanks. That simplifies matters for me :)
4)”Google ” Services Tweak ” to Get XP running much faster”. Thanks I’ll put this tip to immediate use
5)You are 100% right. Mercifully heuristics is there & most security apps use it. Had we only had signature method to fall back on our comps would have died several times by now simply because coders often find it difficult to write signature code fast enough to catch newer pests. The Conficker worm is a recent example. It defeated most security apps. Slimy guy. :( Fortunately that problem is now solved :)
6)Thanks for tip no. 6. I’ll do this. Same goes for tip numbers 7, 8 & 9 too.
Now for this Smiley thing you asked me. I learned there are 2 ways of getting Smilies – the safe way & the unsafe way. The unsafe way is “Smilie websites”. Some of those websites often run a promotion – for every smilie you download they give you one virus free with it. Just joking :D
There are 3 safe ways:-
1)Download 91 Smilies from Yahoo. It gives you a cheatsheet of how to type out the Smilie
2)Take it from Codex. It gives you a cheatsheet of how to type out the Smilie – it also gives good WordPress tips regarding Smilies. Our blogsite btw uses WordPress
3)Locutus our administrator in http://www.dottech.org taught me that if you type : followed by ) you get :) & if you type : followed by D you get :D You can meet Locutus on our main blog or inside the forum. Locutus btw is sensible, humorous & helpful in equal measure
Regards,
Ramesh :)
@Locutus
Hi Locutus! :)
I’ve just made a commitment to our friend Bill3. I quote – “Locutus our administrator in http://www.dottech.org taught me that if you type : followed by ) you get :) & if you type : followed by D you get :D You can meet Locutus on our main blog or inside the forum. Locutus btw is sensible, humorous & helpful in equal measure.
I do hope you won’t embarass me by disagreeing with me on this matter Locutus :D :D
Regards,
Ramesh :)
@Ramesh Kumar: I knew following this thread was a good idea :D
Here’s a table with all of them:
http://codex.wordpress.org/Using_Smilies
lol :lol:
:mrgreen:
:confused:
@Locutus:
No need to be.
You are sensible, humorous & helpful in equal measure & dottechies are lucky because of it.
So let me say – Hail Locutus – Benevolent Monarch of all he surveys……..or some such thing.
LOL
Ramesh :arrow: :mrgreen:
To disable some items from the computer’s startup there is the excellent “AnVir Task Manager” that you may get (regular version – $39.95) for free on a special website I know :
http://dottech.org/freebies/dottech-exclusives/7292
I use the Pro version of it and I don’t know what I would do whitout it !
BTW check the other “Best Freebies” of that site !!! ;-)
@Spoutnik: This is the same site! Have you been copy and pasting comments from one site to the other, or are you just careless?
@Adrian: I think he was joking =P.
Ashraf, one more time you’re right ! ;-)
You changed your name!
@s: No, i have been Ashraf since i was born :P.
@Ashraf:
Hi Ashraf! :)
Your comment no.145 was hilarious. I think s was referring to Spoutnik changing his name to Sputnik!
Since once again this day started with a laugh I am sure its going to be yet another great day :arrow: :lol:
Btw s – you do have sharp eyes!
Ramesh :)
Thanks Asraf for all the good work that you do :-)
I always tell all my friends and family to do research on what ever program they want to install, and to look at your site first for free/better programs than work better!!
first!
Keep up the good work that you do!
@Ramesh Kumar:
Don’t know much about my eyes being sharp. Its just that I was browsing through these posts and read Adrian’s comment no. 141 which I thought was very easy & simple way to say things in a humorous way.
And I got interested in knowing how Spoutnik was going to reply. As I re-visited this page 3-4 times before Spoutnik actually replied, that was easy to spot.
I wonder if he is going to delete ‘u’ or ‘i’ next time he posts.
@Ramesh Kumar: Hi Ramesh,
thanks for the advice on smileys.
1 Do the keyboard instructions work on all websites.
2 Please can I have the instructions for the rest as the green one.
Probably you have a Dottech link with all this on, and I’ll research the rest.
SPOUTNICK RE 140 if you read my comments, you can find many free Start up Managers.
Regards Bill3
Its happening again.
Now, that is the third version of his name, only this time its not by Spoutnik himself.
It was expected but not exactly this way.
Deletion of a vowel was what Spoutnik would have liked.