IMO it's generally not worth it to upgrade as you would be installing a new OS on top of old hardware components...and there is a greater chance of experiencing problems at some point.
As for avast...it is a good anti-virus if you don't want to pay but an anti-virus program alone does not provide comprehensive protection and cannot prevent, detect and remove all threats at any given time. Anti-virus software is inherently reactive
...meaning it usually finds malware after a computer has been infected. The security community is in a constant state of change as new infections appear and it takes time for them to be reported, samples collected, analyzed, and tested by anti-virus researchers before they can add a new threat to database definitions.
Please read Supplementing your Anti-Virus Program with Anti-Malware Tools
which explains why.
Further, no amount of security software
is going to defend against today's sophisticated malware writers for those who do not practice safe computing and stay informed. It has been proven time and again that the user is a more substantial factor in security than the architecture of the operating system or installed protection software. Therefore, security begins with personal responsibility
and following Best Practices for Safe Computing
. Knowledge and the ability to use it is the best defensive tool
anyone can have.