The slickest-looking of this group is surely avast!, with its fancy, media player-like interface. You choose where to scan, set a few options, and click the Play button. The product can hide in the background while scanning. In a nod to the piratical program name, the quarantine area is called the "Virus Chest."
When avast! detects malware running in memory, it offers to restart the system and run a boot-time scan (Windows NT/2000/XP only). You can also request a boot-time scan manually. This scan takes place before Windows has fully loaded, which means it may remove rootkits and other persistent threats. When we tested it on spyware-infested systems, it requested an on-boot scan. We let it delete all suspicious files. On restarting, it again detected malware and asked for another on-boot scan. In the end, it removed half of the spyware.
When preinstalled, avast! blocked a third of our test spyware instantly, blocked installation of another third, and missed the remainder. It did, however, block one keylogger and disable another.
The program's Virus Recovery Database helps to restore files if a virus can't be removed cleanly. By default, it maintains this database while the system is idle, though you can choose "Generate VRDB Now!" to finish the initial analysis quickly.
In addition to scanning e-mail and attachments (both incoming and outgoing), avast! blocks suspicious e-mail activity—too many messages in a short time, or too many recipients per message. It can scan attachments arriving by any POP3 or IMAP mail account, through newsgroups, via P2P file sharing, or from over a dozen different instant-messaging clients.
Unlike the other two, avast! won't schedule a regular full virus scan—that feature is reserved for the professional version. The pro version also offers an enhanced user interface and a handful of added features like script blocking and scanning from the command line. But the free version functions perfectly well without these additions.
