Win32 Virus Removal

Some antivirus vendors create products that stick strictly to the basics. They clean up systems infested by viruses, Trojans, rootkits, or other threats and they keep new threats from getting a foothold on a clean system, but that's all. The "Plus" in McAfee AntiVirus Plus 2012 ($49.99 Direct, $69.99 for three licenses) is a clue that this product comes with a lot more than just basic antivirus protection. However, test results suggest a need for more focus on those basics.

Unusual Interface
Many security tools use the same standard layout, with tabs along the left, top, or both that let the user view and configure different program components. McAfee takes a totally different approach. Its windows are tall rather than wide, with "drawers" that open (one at a time) to reveal specific components. It's an interesting approach, but I frequently found myself opening and closing drawers, rummaging around trying to locate a specific setting.

The product has what's effectively a second, completely different user interface called Navigation Center. This is a simple scrolling page with links that let you access many of the same features as well as some that aren't found in the drawers. For example, you can launch a scan or access firewall settings using either interface, but to reach the threat map or traffic monitor you have to go through the Navigation Center.

Easy Install, Poor Cleanup
McAfee installed without incident on ten of my twelve malware-infested systems. On the other two, the pre-install scan reported a problem and advised me to contact tech support. Tech support recommended using McAfee's CleanBoot Recovery Disc to clean the system and try installing again. CleanBoot did the trick.

McAfee's full scan reports overall progress as well as a running count of issues found and fixed. A full scan on my standard clean test system took 27 minutes, close to the average of current products. A repeat scan completed in less than two minutes.

When the scanner finds a virus, Trojan, or other serious threat it fixes the problem immediately. At the end of the scan it asks the user whether to quarantine any low-risk "potentially unwanted programs." On a few test systems it requested a reboot to allow cleanup of locked files.

With all scans finished, I tallied the results. McAfee detected 79 percent of the threats, well below the average of 84 percent. At 94 percent, Webroot SecureAnywhere Antivirus ($39.95 direct, 4.5 stars) had the best detection rate of current products. GFI VIPRE Antivirus 2012 ($39.95 direct, 3 stars) and Panda Cloud Anti-Virus 1.5 Free Edition (Free, 3.5 stars) tied for second with 91 percent.

To get a good score in my malware cleanup test a product must not only detect threats, it must actually remove them effectively. Some products with a lower detection rate score well due to thorough cleanup. For example, Norton AntiVirus 2012 ($39.99 direct, 4.5 stars) earned the top score of 7.1 points but only detected 85 percent of threats.

That's not the case with McAfee. Its score of 5.3 points reflects the fact that it left behind executable files belonging to many of the threats, and even left some of those running after its supposed removal.

McAfee had a particularly tough time with rootkits. It detected 86 percent of them, but after the scan finished, half of those it did detect remained running with their rootkit technology intact. In one case its realtime protection detected the same threat after the full scan, blithely promising to remove it after a reboot. Five reboots later I concluded it really was not going to succeed. McAfee's score of 3.9 for rootkit removal reflects this poor showing.

Like almost of the current crop of products, McAfee detected all of the samples identified as scareware?fake antivirus. It wiped out all but one of them completely and scored 9.8 points. For full details on how I derive these scores, see How We Test Malware Removal.

Better Blocking
McAfee did a much better job preventing malware attacks on a clean system. Its SiteAdvisor component blocked many malware-hosting URLs, including quite a few that weren't active at the moment. 60 percent of the tested URLs were blocked at the URL level. McAfee quarantined another 20 percent immediately on completion of the download.

Threats don't always come from known malware-hosting URLs, so I challenged McAfee with a folder full of already-downloaded samples. It went right to work, deleting those it identified as malicious and asking permission to quarantine any potentially unwanted programs. 60 percent of the samples were wiped out in this initial culling.

I launched the remaining samples and tracked how well McAfee blocked them. It detected 89 percent of the samples and scored 8.2. That's quite good, but Webroot scored a perfect 10 on this test, G Data AntiVirus 2012 ($29.95 direct, 3.5 stars) scored 9.0, and Norton was right behind with 8.9.

Like most of its competitors, McAfee detected 100 percent of the scareware threats, and like eight others it scored a perfect 10 against scareware. It also detected 100 percent of the rootkits and scored 8.6. Webroot and Norton scored 10 against rootkits. Clearly McAfee does a lot better if it can whack the rootkits before they have a chance to install their stealth technology. To understand where these numbers come from, see How We Test Malware Blocking.

This entry passed through the Full-Text RSS service — if this is your content and you're reading it on someone else's site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers. Five Filters recommends: Donate to Wikileaks.