You might expect that a free antivirus would come with only the most basic protection, with advanced bonus features reserved for paying customers. In truth, many of the most popular free antivirus tools offer full-scale protection along with a ton of extra features. Avast Free Antivirus gives you more than many competing commercial products. On top of excellent antivirus protection, it adds a network security scanner, a password manager, browser protection, and more. It’s an amazing collection of security features, considering that this product is free.
Avast acquired rival free antivirus company AVG in 2016. Fans of both companies can rest easy; three years later, there’s still no plan to merge them into a single product. Both have many thousands of users worldwide, but each is strong in geographical areas where the other is weak. And the underlying antivirus engine is exactly the same in Avast and AVG AntiVirus Free, as demonstrated in my tests and independent lab tests.
This product is only free for personal use. If you want to use Avast in a business setting, you must upgrade to Avast Premium Security, which replaces both Avast Internet Security and the all-inclusive Avast Premier. It’s a simpler product line than most, just a free antivirus and a for-pay suite.
During installation, Avast offers to install Avast Secure Browser, noting that it’s private, secure, and fast. By default, it also makes this your default browser. The installer also presents a full page devoted to explaining how Avast uses your nonpersonal data, and how you can opt out if you wish.
The biggest part of Avast’s main window is a slate-gray rectangle with a bit of texture, decorated with a status icon and a big button titled Run Smart Scan. A left-rail menu lets you switch from the main Status page to Protection, Privacy, or Performance. Across the bottom, you find a banner offering you a welcome gift. Unwrapping the virtual gift reveals a discounted upgrade to Avast Premium Security. If you reject the upgrade, it offers a 60-day trial. Avast really wants you to experience the suite!
One of this product’s features needs special mention, because it’s virtually invisible, and it’s disabled by default. After you reach into settings and enable Passive Mode. Avast takes pains to avoid interfering with other antivirus tools. If you install another antivirus, Passive Mode kicks in automatically. To avoid conflicts, it disables all real-time scanning and other active protection. You can still launch scans manually. There’s precedent for this behavior—Microsoft Windows Defender Security Center does something similar.
Lab Scores High and Plentiful
It may seem counterintuitive, but antivirus makers typically pay for the privilege of having products included in testing by the independent labs. The companies do benefit from testing, in two ways. A high score gives the company bragging rights. If the score is poor, the company can improve by examining what went wrong. When the antivirus doesn’t bring in any income, a company might be tempted to skip the expense of testing. Not Avast. I follow four independent testing labs that regularly release test reports, and all four of them include Avast.
The analysts at AV-Comparatives perform a variety of security tests, of which I follow four. Products that do well enough to pass the test receive a Standard rating, while those that show advanced features and capabilities can rate Advanced or Advanced+.
Out of the four tests, Avast earned three Advanced+ ratings and one Advanced. That’s quite good, though Avira and Bitdefender Antivirus Plus took Advanced+ in all four tests.
AV-Test Institute reports on antivirus capabilities in three areas: protection, performance, and usability. With six points possible in each category, the maximum score is 18 points. Avast got all six points for usability, meaning it didn’t screw up by flagging valid programs or websites as malicious, and earned six more points for malware protection. It came close in performance, with 5.5 points. AVG precisely matched that score.
A total of 17.5 points is high enough for AV-Test to designate Avast a Top Product. Bitdefender, Kaspersky, and Norton AntiVirus Plus managed a perfect 18 points.
Trying to emulate real-world conditions as closely as possible, the experts at SE Labs capture drive-by downloads and other web-based attacks, relying on a replay system to hit each tested product with the exact same attack. The very best products receive AAA certification; others may be certified at the AA, A, B, or C level.
Avast managed AAA certification this time around. Quite a few other products also reached that level. Among them were Avira, Kaspersky, McAfee, and Norton. Despite having the same underlying antivirus engine, AVG only reached the AA level. Surprisingly, Trend Micro Antivirus+ Security came in with just A-level certification, the lowest score in this round of testing.
MRG-Effitas reports test results a bit differently from the other labs. Products that don’t manage perfect or near-perfect protection simply fail. In the past, Avast has passed the banking Trojans test, and achieved Level 2 certification in the all-types malware protection test, meaning that it let at least one attacker install, but remediated the problem within 24 hours. That wasn’t the case in the latest reports. This time around, Avast failed both grueling tests. AVG wasn’t tested, though it scored the same as Avast the last time both were included.
Of the many antivirus products I track, 10 don’t appear in results from any of the labs. Avast is one of the magnificent seven featured in all four lab reports. I use an algorithm that normalizes all the results to a 10-point scale and produces an aggregate score from 0 to 10. The aggregate score of 9.2 points for this free antivirus product is good; only a few have done better. Looking just at those tested by all four labs, Avira Antivirus is at the top, with 9.9 points. Norton comes next, with 9.8, and then Kaspersky, with 9.7. Bitdefender and Sophos each managed a perfect 10, based on three and two labs respectively.
Avast Online Security
The Avast Online Security extension installs in Chrome and Firefox. It installed automatically when I launched those two browsers. As usual, I had to give permission before the browser enabled it.
Online Security marks up your search results in popular search portals. Green means all clear, red means stay away, and gray means the site hasn’t yet been analyzed. You can click the toolbar icon to give a simple thumbs-up or down to the current page.
If Online Security detects any advertising trackers or other trackers on the current site, it displays how many it found as a number overlaid on its toolbar icon. Clicking the icon gets you a summary of found social media, advertising, and web analytics trackers. You can dig in for details and block some or all trackers on the current site or automatically block all trackers on all sites.
You won’t easily see the SiteCorrect feature in action. It kicks in when you misspell a popular domain name, steering you away from typosquatting sites that try to capture your clicks.
Online Security also watches out for dangerous and fraudulent websites. Avast also filters out such sites before they even reach the browser, but as you’ll see below, that protection must be combined with Online Security for maximum protection.
Avast installs the SafePrice add-on alongside Online Security. Like the similar feature in AVG, this add-on helps you find the best prices when you’re shopping online. Just click its toolbar icon to see what details it found. It also offers coupons, when available.
All is not rosy in the world of Avast Online Security. Firefox recently removed this extension from its collection. Why? Because researcher Wladimir Palant reported that the extension sent vast amounts of information to Avast, seemingly more than required to do its job, and including “two different unique user IDs.”
Avast has been in the security business for more than 30 years. I found it hard to accept that the company would jeopardize customer privacy, so I checked with Avast CEO Ondrej Vlcek. “We have already implemented some of Mozilla’s new requirements,” said Vlcek, “and we will release further updated versions that are fully compliant and transparent per the new requirements.” He also noted that the takedown occurred just 12 hours after Mozilla’s announcement of its new store policies.
But what about all that data sent by the browser extensions? Vlcek went down the laundry list of data points that Palant identified, explaining each. Many, such as the referrer field, feed into URL analysis in the cloud. Some of the fields, such as the page title, “aren’t used and will be removed.” Avast collects the country code for a general idea of location, in lieu of capturing the much more personal IP address. Browser type and version feed into aggregate statistics, though Vlcek said a future version will let you opt out of that feature.
As for the unique user IDs Palant reported, Vlcek confirmed they exist, but said they don’t connect to any personal data. They simply let the cloud-based analysis system match up multiple reports coming from the same source.
When you install Avast, it makes a point of asking permission to gather information, specifically requesting “non-identifying data” and stating the data “is fully de-identified and aggregated and will not be used to personally identify or target you.” You can click to agree or decline the sharing request. I asked if declining to share data meant that Avast wouldn’t use those unique identifiers. Vlcek said no, the only difference is that if you agree to share, Avast retains and aggregates data reported by the browser extension, while if you decline, it discards the data after use.
Just about every antivirus product includes the ability to steer your browser away from unsafe or fraudulent URLs. To do this, they must send the URLs you visit to the cloud for analysis. Yes, that means that they could construct a complete record of your browsing activity. But any actual misuse of that data by a security company would spell its destruction.
Previously called SafeZone, Avast Secure Browser is a Chromium-based browser with a boatload of security features built in. Naturally it includes the same protections offered by Online Security. It also blocks ads and flash content, prevents installation of dangerous extensions, controls which sites can use your webcam, and enforces use of secure HTTPS connections wherever possible. From its security center page you can launch an antivirus scan, switch to stealth mode, install Avast SecureLine VPN bring up the password manager, or clear your browsing history.
Secure Browser’s Bank Mode opens a browser window in a separate desktop that’s isolated from processes running on the regular desktop and protected against keyloggers and other spy tactics. As with the similar SafePay feature in Bitdefender, you can switch back and forth between the regular and protected desktops. In the past, Avast automatically offered Bank Mode when it detected you were visiting a financial site. I didn’t observe that happening this time around, but you can easily flip into Bank Mode manually.
Going beyond the anti-tracking skills of Online Security, Secure Browser offers the ability to disguise your browser fingerprint. What’s that? Well, your browser offers a huge amount of information to websites, because sites can use that information to tune the pages they serve up. They can also process this information into a browser fingerprint that uniquely identifies you, for tracking purposes. Like the standalone TrackOFF Basic, Avast can randomize what the browser reports, just enough to prevent fingerprinting.
By default, the Hack Check feature notes when you log into online accounts and checks whether there’s been any breach associated with that account. You can also enter any email address for an on-demand breach check.
If you’re a Chrome fan, consider using Secure Browser. It’s Chromium-based, so you’ll find it familiar. And it really does offer a ton of privacy and security enhancements.
Decent Malware Protection
Malicious software from the Internet must run the gauntlet of numerous defense layers before it can infect your PC. Avast could block all access to the malware-hosting URL, for example, or wipe out the malware payload before the download finishes—I’ll discuss those malware protection layers shortly. If a file is already present on your computer, as my malware samples are, Avast assumes it must have gotten past the earlier protection layers. Like AVG, Emsisoft, McAfee, and a few others, it checks those files one more time before they execute.
To test Avast’s malware-blocking skills, I opened a folder containing my current collection of malware samples and tried to launch each one. Avast blocked 80 percent of them immediately, wiping them out so fast it left Windows displaying an error message reporting that the file could not be found. It killed off some of those that managed to launch before they could fully install, but missed others, mostly low-risk types.
Avast detected 87 percent of the samples and scored 8.4 of 10 possible points, which isn’t great. Sophos, Windows Defender, and Malwarebytes all detected 98 percent and scored 9.8. Webroot SecureAnywhere AntiVirus detected more, 100 percent, but imperfect blocking of some samples took it down to 9.7 points.
On the other hand, Avast’s score is bracketed by Kaspersky Free above and Bitdefender below. All three did very well in lab tests but not so well in my hands-on tests. When that happens, I give more weight to the labs, with their extensive staffs of research experts.
Unusual activity by a few files merited deeper examination. Avast displayed a message stating, “Hang on, this file may contain something bad,” and promising an evaluation within 15 seconds. A little animation depicts the analysis process, with a magnifier going over a document. All my hand-coded testing utilities triggered this warning; all three got a clean bill of health.
The samples I use for the malware blocking test stay the same for months. To evaluate each product’s capabilities against the very latest malware, I start with a feed of malware-hosting URLs supplied by MRG-Effitas. Typically these are no more than a few days old. I try to launch each one, recording whether the antivirus blocked access to the URL, vaporized the malware download, or totally failed to notice anything wrong.
Once I’ve recorded results for many dozens of malware-hosting URLs, I tally the results. Initially, I found that Avast blocked around 40 percent of the URLs and eliminated roughly 40 percent more during download, for a total of 81 percent protection.
Avast has done quite a bit better in the past, enough so that I went seeking a reason for the difference. It turned out I had to run this test again. I had used Internet Explorer as the browser, forgetting that Avast doesn’t have an extension for IE. When I re-ran the test using Chrome, the extension kicked in to help out, bringing Avast’s score up to a respectable 90 percent.
McAfee, Sophos, and Vipre Antivirus Plus hold the top score here. In their latest tests, all three managed 100 percent protection.
Excellent Phishing Protection
Phishing websites are significantly easier to create than websites that secretively launch malware attacks. All a phishing fraudster need do is create a convincing replica of a sensitive site. They go after banks and financial sites, but also try to scam such things as gaming and dating sites. Any user who logs in, not recognizing that the page is fake, has just given away account access to the fraudsters. If a thousand web surfers spot the fraud and just one falls for it, that’s a win for the bad guys. And when the authorities quash the fraudulent site, the fraudsters just pop up another one.
I test antiphishing using the very newest phishing sites, including plenty that haven’t yet been fully analyzed and blacklisted. I launch each probable phishing URL in four browsers. The product under test protects one of the browsers, naturally. The other three rely on protection built into Chrome, Edge, and Firefox.
Any schmoe can write a phishing protection module that blocks blacklisted sites. The best products use real-time analysis to identify frauds that are too new for the blacklists. Avast clearly has this capability; the company touts its enhanced real-time phishing detection technologies.
In my first round of testing, Avast only caught 81 percent of the fakes, way down from last year. I realized that because I used Internet Explorer for that test, I wasn’t getting full protection, as Avast doesn’t offer a browser extension for IE. I ran the whole test again using Chrome, with much better results.
Avast blocked some frauds below the browser level, displaying a popup reporting the page was “infected with URL:Phishing.” I saw this same popup when I tested with IE. However, for other URLs Avast Online Security steered the browser away from the page to a warning page stating, “This website is unsafe.” In some cases, it did both. With two layers of protection in play, Avast detected 97 percent of the frauds, the same as Webroot. It beat Edge handily, edged out Firefox, and was in turn edged out by Chrome.
Kaspersky and Trend Micro pulled a perfect 100 percent in their latest tests. Close behind them, Bitdefender, McAfee AntiVirus Plus, and Norton managed 99 percent.
If you just click the big button in the middle of Avast’s Status screen, it runs a Smart Scan. In addition to a quick check for active malware, this scan looks for browser threats, apps with missing security patches, and what it calls “advanced issues.” On my test system, it only found the last category.
Digging in for details, I found three efforts to upsell me to Avast Premium Security. It pointed out three sensitive folders needing protection from ransomware, noted that the system has only a basic firewall, and warned that hackers could hijack my DNS. Clicking the big Resolve All button sent me to the upgrade page.
Clicking Scan on the Protection page gets you more choices. The Full Virus Scan took 34 minutes on my standard clean test system, and a repeat scan ran eight minutes faster. That’s quite a bit speedier than my last test of this product, probably because since that time I upped the number of virtual processors in my virtual machines.
Avast offers a boot time scan, designed to eliminate pernicious and persistent malware that resists normal cleanup. Because the scan runs before Windows boots up, the Windows-based malware doesn’t have any chance to defend itself. You should set aside plenty of time for the scan. Two hours after I started it, the display still reported one percent complete. I checked its log in the morning, but alas, it doesn’t report scan duration. Note that Bitdefender’s Rescue Mode reboots in a non-Windows operating system for even more power against Windows-centered malware.
Avast was one of the first security products to add a network security scanner to its product line. Despite “Wi-Fi” in its name, the Wi-Fi Inspector can report on all the devices connected to any network, wired or wireless, and flag devices with security problems.
On my test system, the scan ran quickly and displayed my devices in a series of concentric rings, with the router at the center and the devices that connected most recently in the inner circles. The scan reported one problem—it warned that the HTTPS port on the main router was visible from the Internet (a necessary configuration setting for my Network Attached Storage backup device). The detailed warning included a suggestion to install Avast’s VPN, along with a link to open router settings.
Avast does its best to identify each device by name and type, but it can’t always get that information. If you have some network skills, you may be able to identify a device from its IP address and MAC address. The vendor name may also offer a clue. You can change the type of any device to any of more than five dozen choices, among them vehicle, drone, and hand-held gaming console. You can also change the name to something more recognizable than, say, Unknown70259bb1f4e. And Avast remembers your changes for future scans.
In testing, I had a tough time finding the desired device type, because those five dozen entries aren’t in alphabetic order. With Router, PC, Mobile phone, and Tablet at the top, I’m guessing they’re ordered by prevalence.
Avira users can install Avira Home Guard from the main Avira launcher; it works very much like the Wi-Fi Inspector. Bitdefender Home Scanner is another similar (and free) network security scanner, one that goes into more depth about possible security problems.
Simple Password Manager
Password management is an unexpected feature for a free antivirus, though Avira offers Avira Password Manager as a companion to its free product. Avast Password Manager handles all the basic functions, and does them well, but that’s as far as it goes.
To get started, you activate the password manager as an extension in Chrome, Firefox, and Secure Browser. Alarmingly, Avast does not force you to create a master password. You absolutely should not proceed without doing so. Click the settings link, and click the big Create Master Password button.
Avast doesn’t rate your password with a strength meter, but it pops up notes pointing out any problems. For example, when I entered “Password” it said to avoid common words. Entering “d8cd8fb” got the comment “Now that’s a password with muscles.” Adding three exclamation points brought the password to excellent status.
In each supported browser, Avast offers to save the login credentials you enter for secure sites. When you revisit a website, it fills in your saved credentials right away. I do prefer password managers like Keeper Password Manager & Digital Vault that require a click from the user before filling credentials. Doing so prevents password theft using invisible forms.
If you have multiple accounts on the site, you can click a little key icon in the username field to get a menu of all your choices. And it does handle Skype and other two-page logins.
With many password managers, clicking the toolbar icon gets a menu of logins. Avast works differently. If you’ve saved one or more sets of credentials for the current site, it displays those in a popup window. If that’s not what you want, there’s a link to open the app. From the same window, you can invoke the random password generator, which creates 15-character passwords using letters and digits (but not punctuation) by default.
In the app, you can edit your saved passwords to give them a friendly name. You can also add Secure Notes and Credit Card details. When you visit a web form that asks for credit card data, you click the Avast key icon to fill in the card of your choice. In addition, you can sync password data to Avast’s iOS or Android apps.
Avast isn’t much help if you’re switching from another password manager. It can import passwords stored in Chrome or Firefox, but that’s it. There’s no import from competing products, or even from plain CSV files. In addition, the password manager doesn’t report on weak or duplicate passwords.
Some password management features hide behind a paywall, with a list price of $1.58 per month, currently discounted to $0.99 per month. Paying customers get tech support on a 24/7 basis, receive an immediate alert on detection of a password leak, and can log into the mobile apps with a fingerprint. These aren’t very impressive as premium features. Truly advanced features like two-factor authentication and secure password sharing just don’t appear. If you want more from a password manager, you’re probably better off adding a separate free password manager.
Software is created by humans, and hence imperfect. White hat and black hat hackers are constantly finding security holes, and security companies strive to patch them as soon as possible. If you fail to apply security updates, you leave your computer open to attacks that exploit those holes. Avast’s Software Updater scans your computer and reports any out-of-date software it finds. You can click a link to find out what changed in each product, or click a button to install the updates. If you try to turn on automatic updates, you learn that this is a feature of the paid security suite. On my test system, it found an update for Firefox and reported that Flash and Java were up to date. I was left wondering if those are the only apps it checked. No Chrome? No other extensions?
When Do Not Disturb mode is active, the antivirus postpones scheduled scans and suspends all but the most critical notifications. This kind of feature is becoming very common in antivirus products. Avast notices when you run a program full-screen and offers to add it to the list. To avoid being a disturbance itself, it only does so after you shut down the full-screen program.
The Protection, Privacy, and Performance pages each contain some features that are locked away from users of the free edition, indicated by a lock icon overlay. Clicking one of these displays a little animation explaining the feature, with a big Upgrade Now button. In the current Avast lineup, if you want any of these you must purchase Avast Security Premium.
On the Protection page, locked icons include: Firewall, to keep hackers out of your system; Sandbox, to run suspicious files without risk; Real Site, website confirmation beyond detection of phishing frauds; and Ransomware Shield. This last item deserves some explanation. Avast’s regular behavior-based detection should catch ransomware just as it does other types of malware. On the chance it might slip up, Ransomware Shield bans unauthorized modification of your documents and other sensitive files.
Most features on the Privacy page are locked for free users, all but the password manager. You must upgrade to get the secure deletion Data Shredder (AVG gives you this feature at the free level). The Sensitive Data Shield scans your documents for sensitive data that could be vulnerable to exfiltration, and helps you protect it. The Webcam Shield offers a degree of spyware protection by limiting webcam use to known, trusted programs. AntiTrack Premium supplements the Do Not Track protection found in Secure Browser.
The button for Avast SecureLine VPN displays a lock, but it isn’t precisely locked away. Clicking the button starts the installation process. Only when you’ve gone through the process, launched the program, and tried to make a VPN connection do you find out that you must pay $2.89 per month to use it beyond a seven-day trial.
On the Performance page, the locked-up Driver Updater promises to reduce crashes by updating old and broken drivers. It installs the first time you try to use it. If it finds anything, you’ll have to go fetch the update yourself, or upgrade to Premium.
Avast Cleanup Premium works in much the same way. It happily scans your system for performance problems, but if you want to do anything about those problems, you must shell out for a subscription.
An Excellent Free Antivirus
Avast Free Antivirus offers antivirus protection that earns good scores in my hands-on tests and very good scores from the independent testing labs. As for bonus features, it offers much more than many competing commercial products, including a network security scanner, a password manager, and more. Avast remains an Editors’ Choice product for free antivirus.
The base antivirus engine in AVG Antivirus Free is the same as Avast’s, but AVG just doesn’t offer the wealth of additional security features that you get with Avast. Go ahead and try it if you like, but we’re no longer calling it an Editors’ Choice.
Kaspersky Free is our other Editor’s Choice free antivirus. Where Avast gets very good ratings from the four independent labs that I follow, Kaspersky gets even higher marks. It comes with a bandwidth-limited VPN, but not many other frills. The key with Kaspersky is getting antivirus protection loved by the labs without any cost.