Maybe I'm misunderstanding you but you can configure profiles to block outbound traffic by default. The problem is that it's oftentimes not that useful in practice as you need to manually define rules upfront for all apps that should be allowed to access the internet. This easily gets cumbersome if an application uses multiple processes/services of which some need network access (like in case of VMWare Workstation). What's not uncommon either is legitimate installers which launch sub-processes (which need network access) from previously extracted images with randomized filenames. If you've configured the Windows Firewall to block outgoing traffic by default, it will do so without giving the user any hints whatsoever which can make it difficult to figure out what rules to add to get a particular app to work properly.

There're third-party add-on tools to workaround that problem, though. They listen for certain ETW events if I remember correctly and display a message if an app tries to access the network, alongside with options to create (temporary) outbound rules.

Another thing to keep in mind is that rules can be added programmatically which is something some installers do. While this is generally convenient, it can be annoying in cases where one doesn't want (legitimate) software to phone home for example.

No wonder really as AV software has in the past turned out to be an attack vector (MsMpEng Type Confusion anyone?).

https://xkcd.com/1200/ :)

By the time you're depending on active antimalware/antivirus to do its job, it's usually too late anyway, especially if the malware is undetected. It can help, but it shouldn't be your only defense.

A secure browser with ad blocking, a properly configured firewall, sandboxing/virtualization software, locked down file system permissions, along with some common sense and safe practices is the way to go.

I personally use Chrome (with uBlock Origin and uMatrix), Comodo Personal Firewall, Sandboxie, VMWare, Microsoft EMET, and finally Microsoft Security Essentials, along with some other niche security software.

kaspersky is the best it will also scan USB pin drive automatically when inserted also well work for malware and rootkit and have great firewall built in if you go for internet security,kaspersky also provide room for window defender to run by side usually other antivirus disable the window defender upon install nod32 is also good choise

Hi,

Avast acquired Piriform, maker of CCleaner, but recently CCleaner was infected by malware and distributed to 2.3 million users. It was a two-stage backdoor that allows a remote attacker to execute code on an affected system.

hxxps://www.piriform.com/news/blog/2017/9/18/security-notification-for-ccleaner-v5336162-and-ccleaner-cloud-v1073191-for-32-bit-windows-users

hxxps://blog.avast.com/update-to-the-ccleaner-5.33.6162-security-incident

So i believe any antivirus is better for the known threats, not unknown ones.

Regards,
cp74

No. No. No. Just no.

I already explained here why it's the worst firewall implementation one can think of.

I'm using BitDefender as antivirus (some features turned off is a must) - it scores 100% at av-comparatives.
https://chart.av-comparatives.org/chart1.php

For malware - Malwarebytes.

I'm not using firewall, because I'm behind NAT. If I need to filter something I just use hosts file.

Also on Windows - UAC turned off, and built in Administrator account enabled (using it). Win+R, cmd.exe;

Agnitum had a nice personal firewall project you certainly remember : Outpost.
I felt it was just giving all the information you needed is a simple yet very useful interface. Open connections, open ports, open applications but really just the way it's supposed to be. Config was easy and you really could see and understand everything that was happening live.
Somehow, other firewalls do a lot in the back, and you don't always know what's going on or find about it way later.

Unfortunately & on many versions I had too many issues with it and always had to switch back (to zonealarm at that time :p). I wish they would continue the project and make it better.

MS Defender

Yes, Outpost very nice - for many years.

MS Defender or work in wmvare or sandbox

In vmware I have a third-party antivirus installed :D

Each AV user may have different views according to their needs or experience using them.
I have not used Antivirus or Antimalware for a long time ...until Now.
(Kaspersky, AVAst, McAfee, NoDIce, Malwarebytes..etc.) .. As well as Windows Defender - I always disable/turn off it.
reasons : - spend the pc memory
- slow down my pc activities.
- always annoying my activities.
- my PC is very old (1 GB RAM only!!)
I use it if I feel I need it....;)

Commercially… CylanceProtect with FireEye HX, and ESET (or something that is leveraging AMSI) Gartner also recently published an article on Microsoft ATP changing the landscape.

Home use, MalwareBytes, CylanceProtect, ESET/SEP (mainly because of customization allowed)

And the obligatory FireFox w/NoScript, and make sure your using Sysmon.

I think Avira is the best. I've used it for many years now and it's been very reliable and fast. I have McAfee on my work computer and I can always tell its hogging my system.

Avira = Avast = MsMpEng
They are good at caching keygen-warez-ware. Avoiding these av vendors if you want to catch real viriis (IMO).

I think all has been said in meanwhile...
Earlier I was using Bitdefender and since couple of years Avast.
Both helped me to stop some invaders, but this is not against other programs.
Think you should decide it by your own