What Is Windows Antivirus Software? Free vs. Paid vs. One-Time
The basics of what antivirus software does and how to choose between free, subscription, and one-time-purchase options.
The Basic Role of Antivirus Software
Antivirus software detects malicious software collectively known as "malware" — computer viruses, worms, trojans, ransomware, and more — and prevents it from running, or quarantines and removes it. As the range of modern threats has broadened beyond simple "viruses," these products are increasingly called "security software" instead.
Free vs. Subscription vs. One-Time Purchase
| Model | Characteristics | Good fit for |
|---|---|---|
| Free (e.g. Windows Defender) | Zero cost. Basic protection. No ads. | Most general users with no special requirements |
| Subscription (monthly/yearly) | Ongoing feature updates and support. Easy to forget to cancel and keep paying. | People who want the latest features and hands-on support at all times |
| One-time purchase | Pay once and you're done. Signature database updates are often provided separately. | People who want to avoid subscriptions and lock in cost upfront |
One-time-purchase products can look like "buy it and you're finished," but in practice they still need a mechanism to continually update malware detection patterns and YARA-style rules. Before buying, it's worth confirming whether signature updates are provided indefinitely or only for a limited period.
Understanding Detection Methods
- Hash matching: The most basic method — comparing a file's hash value (a kind of fingerprint) against a database of known malware. Can't detect anything if the file changes even slightly.
- YARA rules / signature-based: Describes characteristic patterns within a file as rules, allowing some detection of variants. See What Are YARA Rules? for details.
- Heuristic analysis: Infers unknown threats from behavioral traits, such as suspicious API call patterns.
- Cloud-based verdicts: Checks file information against a cloud database, reflecting the latest threat intelligence immediately.
Many products combine these into "multi-layer defense." A product that relies on only one method tends to miss whatever threats that method is weak against.
Consider Options Beyond Antivirus
In recent years, the approach of splitting security by role has become more common — file scanning (antivirus) on one hand, and tools that notice tampering of important files (EDR) or check the vulnerability of the network devices themselves on the other.
Summary
- Antivirus software is offered as free, subscription, or one-time purchase
- Even for one-time-purchase products, always confirm whether and for how long signature updates are provided
- Products combining hash matching, YARA rules, and heuristics are preferable
- Thinking beyond PC protection to file tamper detection and network scanning gives more peace of mind
A one-time purchase for $6.25
ShieldGuard provides multi-layer detection (hash matching, YARA rules, heuristics) with no subscription.
See ShieldGuard