I always recommend Webroot. It's by far the lightest on system resources, high detection rate, sandboxing and it journals unknown applications that it uses cloud analytics to determine good or bad. If it determines something to be bad it reverts everything the application did from the journal. It can even revert ransomware encrypted files if it doesn't detect it initially.