Win32 Virus Removal

Many security vendors have begun pumping features commonly associated with security suites into their nominally standalone antivirus products, McAfee among them. McAfee Total Protection 2011 ($79.99 direct for three licenses) is almost indistinguishable from the feature-filled McAfee AntiVirus Plus 2011 ($39.99 direct, 3.5 stars) at first glance. The only visible difference, outside of the name, is a panel for Parental Control. Other additions come to light when you open specific feature panels. For example, spam filtering (which is only in the suite) shows up under "Web and Email Protection."

Possibly in recognition of the closing gap between their antivirus and full suite, McAfee is currently offering a $20 promotional discount on the suite, so it costs the same as a three-license subscription for the antivirus. Besides spam filtering, the suite also adds online backup of important files (powered by Mozy), limited parental control, and tools to protect your files.

McAfee's suite includes an upgrade from plain SiteAdvisor to the more powerful SiteAdvisor Plus ($19.99 if purchased separately), but otherwise its protection against malware is exactly the same as that of the standalone antivirus, as is the firewall protection. I'll start by summarizing those results.

Better Malware Blocking Than Removal
McAfee gets mixed grades from the independent labs. While West Coast Labs and ICSA Labs certify it for virus detection and removal, it failed to attain VB100 status in the latest Virus Bulletin test. AV-Comparatives.org and AV-Test.org both rate it high in some areas but just acceptable in others.

Getting McAfee installed on my malware-infested test systems wasn't as difficult as with the 2010 edition, but it still required devoting two valuable hours of my time to phone-based tech support. McAfee's full scan wipes out high-risk threats on sight and asks for permission to remove lower-risk threats. Real-time protection kicked in immediately on install in many cases, but even after many, many reboot and remove cycles McAfee couldn't remove one threat thus detected.

In testing, McAfee detected 82 percent of the threats; quite a few competitors have detected more. McAfee didn't fully remove all the threats it found, resulting in an overall score of 6.6 points for malware removal. Norton Internet Security 2011 ($69.99 direct for three licenses, 4.5 stars) topped this test with 7.9 points. McAfee's scores in sub-category tests were so-so. For full details on how I test malware removal and derive these scores see How We Test Anti-malware

In the malware blocking test, McAfee did much better. Its SiteAdvisor component set a new record for blocking initial download of threats, and McAfee quickly wiped out most of my already-downloaded samples.

McAfee detected 89 percent of the sample threats and scored 8.9 points for malware blocking. That's a very good score, tied with Comodo Antivirus 5.0 (Free, 3.5 stars) and beaten only by Webroot Internet Security Complete 2011 ($79.95 direct for three licenses, 4 stars), Panda Cloud Anti-Virus 1.1 (Free, 4 stars) and Ad-Aware Pro Internet Security 8.3 ($39.95 direct for three licenses, 4.0 stars) with 9.0, 9.1, and 9.2 points respectively.

McAfee's sub-category scores were less impressive. In particular, it detected 78 percent of rootkit samples where seven other products have detected 100 percent. For full details on how I test malware removal and derive these scores, see How We Test Anti-malware

Simple Firewall
The firewall component in McAfee's suite is exactly the same as that provided as a bonus in the standalone antivirus. It hides the system from outside attack and manages which programs can access the Internet. However, its program control allows outbound access for all programs by default; it only queries the user when an unknown program tries to accept inbound connections.

The program control system was easily fooled by most leak test programs and the firewall only identified six of two dozen real-world exploit attacks. It resisted my attempts to disable protection using Task Manager and the Registry but succumbed to simple tweaking of its essential Windows services. For full details refer back to my review of McAfee AntiVirus Plus 2011.

Network Management
McAfee's home network management system is easy to use. Just enter the same password on all computers equipped with McAfee's antivirus or suite and you can monitor other installations and fix problems across your home network. Norton and Panda Internet Security 2011 ($79.95 direct for three licenses, 3 stars) offer network management that's view-only. Besides fixing problems remotely, BitDefender Total Security 2011 ($69.95 direct for three licenses, 3.5 stars) allows various remote actions such as triggering an update or launching a scan.

The full suite adds active protection to home network management. For the first few days of operation it learns your existing network layout, automatically marking as trusted any devices it detects. Thereafter it will warn when any new device appears on the network, giving you the opportunity to mark that system as an intruder. You can also change the status of any device from within the network map. Naturally those marked as intruders get zero access to the network.