Paid does not equal quality nor does free equal lack thereof. Some of the best programs out there are free, and many are Open Source.
I have
never used a paid security product on any computer I had control over and have remained infection free on those machines. On other computers, such as those at my former workplace, where they had "Enterprise-level commercial" protection programs installed (Symantec), I cannot make that same claim.
As I said, commercial programs, like Symantec's, are not
bad, but they do have a bad tendency to heap feature after feature into the newest version, rather than make incremental improvements that are less noticeable, in order to justify making people pay for the "latest and greatest!". This is called "feature creep" and makes programs slower, less efficient, and more prone to errors; it is certainly not specific to commercial programs but is, in my opinion, more prevalent there.
Most non-open source but free security programs, like Avast! also come in "professional" versions that include extra bells and whistles. Among the bells added to Avast Professional is the ability to schedule regular scans and a nifty-looking interface. The free version detects all the same badies as the paid version, it's just missing a few extras.
Another problem I have with programs like those from Symantec, McAffee,
et al, is that they try to be your all-in-one security suite. They usually include a software firewall, virus scanner, spyware scanner, web browsing filter, and lots of other features. This is yet another example of feature creep, at least in my opinion. Also, I think it's wise to cultivate a heterogeneous array of security programs to reduce the possibility of an error in one program or facet of a full suite affecting the other parts.
For example, I use
Avast as my anti-virus. It scans files as I access them and monitors my web browsing to intercept bad files before they're even downloaded. I also have
Comodo Firewall (also free) as my firewall. It monitors ingoing and outgoing network connections and only permits connections that I have already approved. For my anti-spyware defenses I use
Spybot Search& Destroy and
Adware Free (both free). They scan for (and SB S&D proactively prevents some) spyware. I also
check the MD5 hash1 of any file I download against
VirusTotal's database.On top of this I run
Firefox with
NoScript and
AdBlock Plus.
There ain't nothing gonna get through all that
2, and I didn't spend a dime.
1 Disclosure: I wrote this program
2 I know, never be too confident.