Actually...the safest way is to laugh at the advertisements parroted by those who have swallowed the Windows 10 BS and prefer umbilical cords. The question asked was directed at those who have a more extensive scope of knowledge, and thankfully, there are quite a few of them here.
When I was refurbishing a Dell D600 laptop back in April, I installed Avast Free Edition. I haven't paid much attention to details like program version though. It could get latest virus databases and that's all there was to it. On my XP virtual machine, which I set up on March 2016, I installed AVG Antivirus Free, and even this year it could get new virus databases. Then again, I haven't used it for some time. Sorry, but I'm about to off-top, as I just can't pass by these lines indifferently: Dude, is this really true? I bet this machine costed a few hundred dollars, is probably a lot more powerful than your Windows XP machine, and you keep it unused in box? That's a real waste! I understand that you have some stuff that doesn't work well in 10, and you hate Windows 10 itself. I started to dislike it too once its quality started to go downhill with every new bigger update. But still... Going back to your question, does this machine have to be connected to the internet? It could be a good idea indeed to cut-off internet connection to it, but preserve the access to local network at the same time.
I know this sounds like a fool's errand to do, but I personally don't run an active antivirus on my XP laptop. I just don't. I don't often download things, and I only really browse MDL, YT and Craigslist at this point. If I feel like I might have gotten something on the machine I can also just pull the SSD and attach it to my desktop and run a full drive scan. I know there's AVs that support XP but I'm not knowledgeable about their databases, who knows if they're even truly kept up to date as they claim. It's easier to just be careful about downloading random stuff. It's unfortunate admin privileges are wonky on XP compared to Vista etc.
While that is true AVG Free does tend to come with a pile o' crapware that assures you it found junk files and registry errors and other ish. I've found it is a little heavy handed with just deleting files it finds suspicious too.
AVG is part of AVAST software nowadays. UI look very close to AVAST one and there is no lot benefits compared AVAST.
True enough. Free antiviruses all have their ups and downs though. Sometimes just using a brain and some common internet sense works just as well.
That is not fool as long as use common sense on web and got proper firewall either PFSENSE or if router got good one (I recommend PFSENSE) I do so to my older XP laptop that is too slow for AV and to my win2000 system.
Additoinally if worst comes to worst I can just stick the drive into my other computer and run a scan. Though it's been fine as-is for a long while.
Also proper browser and addons on it helps for example I run ff 52 esr with ublock origin on XP to keep malwertising off on shady pages
I just built an retro XP gaming system. It wont be connected to the internet. I was thinking about default deny based software but that can be annoying, I think I am just going to keep it offline forever.
For XP I would not bother with anything definition based (as in gets updates). With exploits being the optimal attack vector against an XP machine you are better off with software that default denies anything not previously put on a white list or simply never connecting. It can be annoying getting prompts to allow execution but realistically this is the only way to actually secure XP at this point. XP machines also have the additional issue of out of date BIOS. Anything running XP likely stopped getting BIOS updates long before all of the mitigations started getting released. With an unsecured BIOS a 'foot in the door' attack automatically because a root foothold.
windows xp sp3 + posready update and symantec endpoint protection 12.1 + mozilla firefox with ublock origin + https everywhere and enabled tls 1.1 and 1.2 ( registry tricks )