McAfee AntiVirus Review: Powerful Antivirus Protection for a Single PC

Don’t go looking for this antivirus on McAfee’s website. McAfee strongly encourages new customers to enter at the suite levelchoosing either McAfee Total Protection for a fixed number of licenses or the unlimited-device subscription to McAfee+. At its higher pricing tiersMcAfee+ also comes with a comprehensive identity theft service.

If you want to purchase McAfee AntiVirusyou’ll need to visit a McAfee partner such as Amazon and Best Buywhere it lists for $49.99 per year. That’s the same as Bitdefender’s one-device price (you can read a full comparison between McAfee and Bitdefender here). Most antivirus utilities charge less for a one-license yearly subscription. For exampleEmsisoft Anti-MalwareESET NOD32 AntivirusTrend Micro Antivirus+ Securityand ZoneAlarm Pro Antivirus + Firewall all go for just under $40.

That’s it for McAfee’s pricing scheme. If you want to protect three computersyou buy three licenses—or you switch to a McAfee suite. This is an uncommon modelthough Trend Micro and Webroot Essentials work the same way. Most antivirus companies offer volume discounts for threefive10or even more licenses. The average per-device price for a three-license subscription is about $18less than half the one-device average. At five licensesthe average drops to $13and at 10 licensesit’s less than $10.

Similar Products

Our Current Picks for The Best Antivirus Software for 2026

Bitdefender Antivirus Plus

4.5

Outstanding

See It Read Our Review

Norton AntiVirus Plus

4.5

Outstanding

See It Read Our Review

Emsisoft Anti-Malware

4.0

Excellent

$29 at Emsisoft Read Our Review

ESET NOD32 Antivirus

4.0

Excellent

$79.98 Save $19.99

See It Read Our Review

G Data Antivirus

4.0

Excellent

$29.95 at G DATA Software

$29 at G DATA Software Read Our Review

Malwarebytes Premium Security

4.0

Excellent

$44 at Malwarebytes Read Our Review

Sophos Home Premium

4.0

Excellent

See It Read Our Review

Webroot Essentials

4.0

Excellent

$24.99 for 1 Device on 1 Year Webroot Essentials Plan at Webroot

See It Read Our Review

When it was availableMcAfee AntiVirus Plus cost users $64.99 per year to protect all the devices in their households. Since it has left the marketthe only unlimited-license antiviruses I cover are Panda Dome Essential and TotalAV Antivirus Prowhich cost $119.99 and $198respectively. Every time you install one of these on another deviceyou lower their per-device price.

Of coursewith a free antivirus like AVG AntiVirus Freeyou effectively have unlimited licenses. Avast One Basica stripped-down version of Avast One Goldalso costs nothing and protects all four popular platforms. These two are our Editors’ Choice winners in the free antivirus realm.

To install McAfeeyou first go online and activate your license key. If you configure your account for automatic renewalyou get a Virus Protection Pledge from McAfee. That means if any malware gets past the antivirusMcAfee experts promise to remotely remediate the problema service that normally costs $89.95. In the unlikely event the experts can't clear out the malwarethe company refunds your purchase price. Norton AntiVirus offers a similar promise (you can read our full comparison between Norton and McAfee here)as does ZoneAlarm Extreme Security.

With that housekeeping out of the wayit's time to download and install the antivirus. I was pleased to find that the installer did its job quickly and didn't require handholding from me. I did accept its offer to install the essential Web Protection in my default browser; you should too! Once installation is completethe antivirus starts protecting you right away.

A large panel at the top left of the main window offers suggested actionsmuch like the recommendations from Bitdefender’s AutoPilot system. To the righta smaller panel reports the on/off status of the antivirus and firewall componentswith links to configure these important components. It also reports any issues with overall device status.

The lower part of the window holds four panels described as Shortcuts. From these panelsyou can run an antivirus scanremove temporary files that might allow tracking of your activitiesconfigure Web Protectionand securely delete sensitive files.

Clicking the My Protection icon at left opens a feature-filled left-rail menu. It offers access to core antivirus taskssuch as launching or scheduling a scan and checking what’s in quarantine. Tracker RemoverWeb Protectionand File Shredder appear in this menu as well as in the row of shortcut panels.

I follow five independent antivirus testing labs that regularly publish reports on their findings. Three of the five include McAfee in their latest reportswhich is a good sign. It means that they consider it significant and worthy of their testing efforts. At presentMcAfee holds perfect or near-perfect scores from those three labs.

Testing experts at AV-Test Institute rate antiviruses on how well they protect against malwarehow light a touch they have on performanceand how little they interfere with usability by wrongly flagging valid programs and websites as malicious. An antivirus can earn six points each for ProtectionPerformanceand Usabilityfor a maximum of 18 points. McAfee reached a perfect 18 in the latest report from this labas did more than half of the other competitors.

Researchers at SE Labs use a capture and replay system to challenge multiple antivirus tools with identical web-based attacks. Each antivirus can earn certification at five levels: AAAAAABand C. In the latest round of testingalmost all the tested programsincluding McAfeereceived AAA certification. Other antiviruses that reached the AAA level in the latest reports include AvastMicrosoft Defender Antivirusand Panda.

AV-Comparatives regularly publishes a variety of tests; I follow three of them. Apps that pass a test receive Standard certification. Those that achieve exceptional success can earn an Advanced or Advanced+ rating. McAfee missed perfection by a hairwith two Advanced+ certifications and one Advanced. AvastAVGand ESET currently hold Advanced+ in all three.

McAfee’s success in the tough tests put on by MRG-Effitas has been uneven in the past. Where most tests report results across a rangethis lab’s tests are effectively pass/failand McAfee racked up a few failures in the past. HoweverMRG-Effitas didn’t put McAfee to the test in its latest report. AVLab Cybersecurity Foundationthe latest addition to my labs collectionalso skipped McAfee in its latest test results.

 I've devised an algorithm that maps all the lab scores to a 10-point scale and yields an aggregate lab score from 0 to 10. McAfee’s scores from three labs yielded a respectable 9.8 points. ESET and Bitdefendertested by four and three labs respectivelyalso scored 9.8 points. Maximum lab attention goes to AvastNortonand Microsoft. These three appear in reports from all five labsscoring 9.89.6and 9.1respectively.

In addition to checking results from independent testing labsI put every antivirus through my own hands-on malware protection testing. Some programs I test don't show up in reports from any of the labsmaking hands-on tests essential. Even for one like McAfeecertified by three labsthis process gives me a chance to experience antivirus protection in action.

In most casesI start by opening a folder containing a collection of malware samples that I have collected and manually analyzedso I know just what damage they can do. For many real-time antivirus componentsthe minimal access that occurs when Windows Explorer checks the file's namesizeand so on is enough to trigger an on-access scan.

McAfee scans files upon download and just before they launchbut it doesn’t scan on simple access. To exercise all the app’s detection componentsI started by downloading my samples from cloud storage. In an impressive feat of protectionMcAfee blocked 100% of the file downloadssending them directly to quarantine.

I maintain a second set of sampleshand-modified so they won’t match simple hash-based detection systems. For each fileI change the filenameappend zeroes to change the sizeand tweak some non-executable bytes within the program. McAfee caught two-thirds of these on downloadincluding all the tweaked ransomware samples. Avast and AVG caught the modified versions of all but 1% of the samples whose originals they detectedwhile Norton nabbed all but 2%.

McAfee’s perfect 100% detection score is matched only by UltraAV. Like McAfeeUltraAV eliminated all the samples on its first try. Unlike McAfeeeven the minor file access that occurs when Windows Explorer displays a file’s data is enough to trigger UltraAV’s real-time protection. Either wayboth quickly wiped out the entire collection. And a perfect 10 points is much better than the 8.5 McAfee scored when last tested.

When tested against this same malware collectionMalwarebytes Premium scored 9.9while AvastAVGNortonand Webroot took 9.7.

It takes a long time to collectcurateand analyze a new set of samplesso I only change to a new set once a year. To see how each antivirus handles the very latest in-the-wild malwareI use a feed of the latest discoveries supplied by London-based lab MRG-Effitas. This feed is simply a list of malware-hosting URLs discovered over the last few days. I load the list into a small program that launches each URL and makes it easy to record whether the antivirus blocked access to the URLeliminated the malware downloador totally whiffed on detection. I continue launching samples until I have data for 100 verified malware-hosting URLs.

McAfee's WebAdvisor component blocked access to 81% of the malware-hosting URLsidentifying some as Risky and others as merely Suspicious. I can’t imagine a sensible user proceeding to a page their antivirus labeled Suspiciousso I counted both types as successful diversions. The warning page also included tags to further define what WebAdvisor foundtags such as Malicious SitesMalicious DownloadsParked DomainConsumer Protectionand more.

The remaining URLs reached the download stage and faced analysis by McAfee’s real-time detection. It sent most of these to quarantine. OverallMcAfee blocked another 16% of the URLs at the download stagefor a total of 97%. That’s goodbut Avira Free Security SuiteGuardioand Sophos Home Premium reached a perfect 100%while NordVPNNortonand UltraAV achieved 99% protection.

After installing a new antivirusyou should always run a full scan. The time for that initial scan varies quite a bitbut the current average is just under two hours. McAfee’s current edition defaults to putting all necessary resources into the scanso it finishes faster. The alternative is to work more slowly in the backgroundavoiding any interference with your ongoing activities.

When I timed a full scan in a clean virtual machine testbedit took three and a half hours to finish. I hate to imagine how long it would have taken without Fast Scanning enabled. A second scan finished in half the timevery close to the average. I suggest just letting that first scan run in the background without worrying about how long it might take. McAfee also offers a quick scanwhich it says takes “5 to 10 minutes.” On that same test systemthe quick scan finished in half a minute.

In theoryyou only need that drawn-out full scan onceas a real-time antivirus should handle new threats. Howeveras a second tier of protectionMcAfee schedules a bi-weekly full scan. You can switch to scanning every week or once a monthor you can create your own custom schedule.

Get Our Best Stories!

Stay Safe With the Latest Security News and Updates

Sign up for our SecurityWatch newsletter for our most important privacy and security stories delivered right to your inbox.

Sign up for our SecurityWatch newsletter for our most important privacy and security stories delivered right to your inbox.

Email

Sign Me Up

By clicking Sign Me Upyou confirm you are 16+ and agree to our Terms of Use and Privacy Policy.

Thanks for signing up!

Your subscription has been confirmed. Keep an eye on your inbox!

When you’ve got McAfee working for you in the background and running scans on a scheduleyou may not be 100% aware of just what it’s doing for you. If you have any doubts or if you’re just curiousopen the My Protection menuscroll to the bottomand choose Security Report. Now you’ve got a nice summary of just what your antivirus has donewith the option to dig in for full details about scansreal-time protection activityand more.

Devising a Trojan for stealing user account credentials requires a malware coder to invent techniques for slipping past layers of antivirus protection and the operating system’s own security features. That’s no easy taskand it’s just the start. The Trojan still needs code to locate those credentials and phone them home. It’s a lot easier to just hoodwink the user into giving away their credentials. Not only thatphishing is platform-agnostic. Any device that has a browserwhether it's a Chromebook or a smart espresso machinecan be your downfall. Even if you're well-trained in spotting these scamsit just takes one lapse.

Phishing fraudsters create sites that masquerade as sensitive sites and spread links through spammalicious adsand the like. Bank sitesonline gamingdating sites—no secure site is immune. If you log in to the fraudulent websiteyou’ve handed your account over to the fraudsters. Such sites quickly wind up blocklistedbut the perpetrators simply spin up new ones.

Because phishing pages are ephemeralI always test using the very newest reported phishing sitesscraped from websites that track them. In addition to known and verified fraudsI make sure to include some that have been reported but haven't yet gone through analysis. This puts pressure on the antivirus to heuristically examine web pages and detect fraud without relying on an always-outdated blocklist.

I launch each URL simultaneously in four browsersstarting with one protected by the antivirus in testing. The other three depend on protection built into ChromeFirefoxand Microsoft Edge. I run through hundreds of reported phishing URLsdiscarding any that one or more of the browsers can’t reach and any that aren't verifiable credential-stealing frauds.

McAfee’s WebAdvisor routinely aces this testscoring at or near 100%. It reached that pinnacle in its last two testsand again this time around. Also at the 100% detection level are AVGAviraGuardioWebrootand the phishing-focused Norton Genieas well as the antivirus component of VPN-anchored security tools NordVPN and Surfshark One.

McAfee’s macOS edition also scored 100% when tested against the same samples.

You’ve seen that WebAdvisor can steer the browser away from both malware-hosting websites and phishing frauds. The browser extension can also color-code results in popular search enginesletting you see before even clicking whether a site is safedangerousor untested.

By defaultWebAdvisor marks up results in all popular search engines. That’s a change from past versionswhich defaulted to only marking up McAfee’s own Secure Search. It also marks up links in FacebookInstagramLinkedInRedditX/Twitterand YouTube. To change its coverageclick the toolbar icon for the WebAdvisor extensionclick the gear icon at the topand select the Preferences tab. Here you can turn off markup for all search engines or for each of the social media sites individually.

Ransomware attacks can be shockingeven frightening. Cryptojacking is much more subtle. You visit a websiteand it co-opts your system resources as part of a distributed system that mines for bitcoin or some other cryptocurrency. Bear in mind that there's nothing illegal about mining for Bitcoin. Mining is where bitcoin and other cryptocurrencies come from. The problem comes when a website or program covertly hijacks your computer's resources to mine currency for someone else. While WebAdvisor used to let you fine-tune its cryptojacking detectionit now simply rolls that protection in with defense against other types of risky sites.

Bitdefender also offers protection against unwanted crypto miningbut only in its security suitesnot in the basic antivirus.

The consequences of a ransomware attack getting past normal antivirus protection are serious enough that many antivirus apps add a dedicated ransomware protection component. I can often simulate the situation where a zero-day ransomware gets past the antivirus by simply turning off all protective layers except those aimed squarely at ransomware.

AlasI can’t do that with McAfeeas there’s no independent ransomware protection component. As with Trend Microturning off real-time protection also turns off protection against ransomware.

Even soI found a way to test this feature. As noted aboveI keep hand-modified versions of every samplewhich I use to check the flexibility of malware recognition. McAfee caught all of thoseso I whipped up a new set of tweaked samplesdifferent from all previous sets and thus never precisely seen before. McAfee eliminated most of these instantly on launch.

Most isn’t allhowever. One modified ransomware sample ran to completionencrypting over 12,000 files and displaying its ransom note. Good thing I run these tests in an expendable virtual machine!

A wiper sample also dodged McAfee’s protection. Wiper malware is similar to whole-disk encrypting ransomwareexcept that it doesn’t offer any way to recover. Wiper attacks reportedly hit Ukraine just before the start of Russia’s war on Ukraine. And my one wiper sample evaded McAfee’s protection even in its unmodified form.

In this simple testMcAfee demonstrated that it can block most ransomware attackseven when the sample is hand-modified to evade detection. Howeverthe fact that it missed one disk wiper attack and one tweaked sampleeven with all antivirus components activeis worrying.

Most security companies reserve firewall protection for the full-blown security suitebut McAfee puts it right in the standalone antivirus. McAfee’s firewall checks outbound network traffic while leaving the built-in Windows Firewall to handle inbound traffic. That means Windows firewall is in charge of stealthing ports and resisting attacks from the webtasks it handles well.

Those of us who've been around long enough remember the early personal firewallswith their maddeningincomprehensible queries. “SlavaUkraini.exe wants to connect to URL 104.18.6.16 on port 8080; allow or block? Once or always?” Consumers just aren’t qualified to answer those questions. Some always allow access. Others always choose block…until they break somethingat which point they switch to allowing everything. It's not an effective system.

In years pastMcAfee’s default was Smart Access modemeaning it made all decisions about allowed network permissions. If you really wanted an old-school experienceyou could dig into the settings and switch to Monitored Accessbut I always advised against doing so. That’s no longer a worryas the current firewall uses neither mode. Ratherit leaves this protection to the built-in Windows firewall. What McAfee does is block attempts by your apps to connect with “risky sites.” I couldn’t manage to see this redundant feature in actionas such attempts were blocked by McAfee WebAdvisor.

Firewall protection isn't much use if a malware coder can craft an attack that disables it. As part of regular firewall testingI attempt to disable protection using techniques that a malware coder could implement. It's hard to believebut you can disable some security programs using a Registry tweaklike changing a value from On to Off or True to False. Looking at McAfee’s presence in the RegistryI found I could delete or modify most of the valuesbut doing so had no noticeable effect on the appand rebooting the system reversed many of my changes.

When I checked running processesI found four belonging to McAfee. The two firewall processes resisted termination. Killing the other two blew away the user interfacebut it came back when I clicked its icon in the notification area.

In a similar fashionwhen I stopped the Windows service that powers WebAdvisorit came back when needed. The main McAfee service was hardened against tweaking. I did find I could set WebAdvisor’s startup mode to Disabledmeaning it would not launch at Windows startup. And yetupon rebootit revived. OverallMcAfee proved resilientresisting my attempts to disable its protection.

Over the yearsMcAfee AntiVirus has dropped quite a few bonus features. Its designers are constantly tuning which features consumers actually use. Two that have survived are File Shredder and Tracker Remover.

You might think the Tracker Remover feature would aim to keep web ads and trackers from profiling youbut what it really does is clean up traces of your computer and browsing activity. Anyone who gains access to your computer can cause all kinds of problems. Even with no malice intendedthey still might snoop around and learn just what you’ve been doing. Tracker Remover wipes out temporary files and empties the Recycle Bin for starters. It also clears cookies and history from ChromeEdgeFirefoxand Internet Explorer. Similar features in other security apps go furtherwiping out things like lists of recently used documents and browser cache filesbut McAfee’s scan is quick and simple.

Out of the boxMcAfee runs the tracker remover scan on a two-week schedule. You can turn off the scheduled removal or change it to run just once a month.

When you delete a file in Windowsit goes to the Recycle Bin. If you find you made a mistakeyou can rescue it from the bin. Even after you delete an incriminating filethe feds can impound your computer and recover that file using high-tech software or even hardware. Secure deletionoften called file shreddingensures that what you delete stays deletedeven against forensic file recovery.

You can right-click any file or folder and choose Shred from the menu that pops upor open the File Shredder within the main app to shred the contents of the Recycle Binthe temp folderor any arbitrary folder. Take care; shredded files are reallytruly gone. By defaultMcAfee runs two shredding passeswhich is enough to defeat file recovery software. If you suspect the authorities may put your computer through hardware-based forensic recoveryyou can choose three or five shredding passes.