Firewall+AV
I only allow my antivirus through the firewall to update it's detection signatures and block it again after updating.
Even the free MalwareBytes will function with it blocked by a firewall. It will still scan and report any nasties but it won't remove anything unless it is connected to the web.
