App Review McAfee: how bad is the worst antivirus?

[Parkinsond]

Some MT members do not consider PCSecurityChannel videos as real tests, but rather as "educational videos" (the term used by the author of PCSecurityChannel videos). Unfortunately, the term "test" has a broad meaning, so people often disagree about the usefulness of "video tests."

We have two sources of data: lab tests and real-life feedback; both should be considered.

 

[anirbandutta01]

Why in YouTube reviews McAfee and Norton always described as the worst antivirus software

Even Dell provides McAfee pre-installed with laptop.

 

[Andy Ful]

We have two sources of data: lab tests and real-life feedback; both should be considered.

Yes. But the relevance of those two sources is very different. One is like modern & accepted medical treatment, and the second is like grandmother's traditional recipes. They can be considered, but not compared.

Edit.
I still use some traditional recipes, and I made a few videotests.

 

[Parkinsond]

like grandmother's traditional recipes

what starts scientific research is the real-life observations; academic field is my bread and butter.

 

[Parkinsond]

Even Dell provides McAfee pre-installed with laptop.

It is logic US-based PC brands are going to favor US-based secruity solutions.

 

[Andy Ful]

what starts scientific research is the real-life observations; academic field is my bread and butter.

Yes, however, real-life observations can be easily misused and misinterpreted. We can see this in most advertisements.

 

[Parkinsond]

Yes, however, real-life observations can be easily misused and misinterpreted. We can see this in most advertisements.

We need both, lab results and real-life observations.

 

[Trident]

Yes, however, real-life observations can be easily misused and misinterpreted. We can see this in most advertisements.

The bottom line is calling McAfee “the worst antivirus” is anecdotal at best. Someone who’s supposedly in the field of “testing” should know better than that. The McAfee technologies generate circa 2 billion annual revenue through the home brand and 2 billion more through the business division.
Of these funds, if 4-5% are reinvested in R&D which is the golden standard, the McAfee technologies are a result of multi-million annual investment.

McAfee has received more than 100 patents just in 2024 and 2025. Everyone can easily look it up on Justia. These patents don’t come “from the sky”, someone is actively working every day 9-5 to generate this technology.

@Shadowra recently tested McAfee and found it to produce similar, if not better results than many other products.

So again, “How bad is the worst antivirus” is clickbait and a desperate attempt to generate $29.95 through ads revenue. Such practices are petty and for that, Leo is simply not credible.

 

[Adrian Ścibor]

What is the methodology of verifying harmfulness?

It is not my job to provide a ready-made solution. However, during testing, you must ensure that the XYZ files are performing malicious actions within the system that could be considered the result of malware activity.

Otherwise, it can be assumed that you are testing something that may not work at all.
In the absence of a signature, the result on the sample is negative and false in the same time.

Our methodology (described on our website) covers all of this, but I don't want to claim that we are better or worse at anything. There is no single, universal method. You simply need good know-how and the ability to develop your own tools for assessing "harmfulness."

 

[Parkinsond]

In the absence of a signature, the result on the sample is negative and false in the same time

That is what I was referring to; in absence of signature, how to verify the malicious nature of the tested sample?

Spoiler: Your statement

 

[Trident]

That is what I was referring to; in absence of signature, how to verify the malicious nature of the tested sample?

Spoiler: Your statement

View attachment 289537

There are many ways you can do that, the quickest way would be to upload on a very reputable sandbox and make sure that malicious actions actually happen.
Watch out for dead c&c or quick, premature termination.
The problem is, this often necessitates the usage of APIs and automation (you gotta pay), because if you are doing it manually (and you still want this large set), by the time you analyse this malware, it will already be 3-days old.

 

[Parkinsond]

There are many ways you can do that, the quickest way would be to upload on a very reputable sandbox and make sure that malicious actions actually happen.
Watch out for dead c&c or quick, premature termination.
The problem is, this often necessitates the usage of APIs and automation (you gotta pay), because if you are doing it manually (and you still want this large set), by the time you analyse this malware, it will already be 3-days old.

So in absence of signature, "verification of harmfulness" as stated by Adrian Ścibor will rely on the tester interpretation of what should be defined as "malicious" behavior.
In case of misinterpretation, not detecting the tested sample is not really false negative, while detecting it is actually a false positive.

 

[Trident]

So in absence of signature, "verification of harmfulness" as stated by Adrian Ścibor will rely on the tester interpretation of what should be defined as "malicious" behavior.
In case of misinterpretation, not detecting the tested sample is not really false negative, while detecting it is actually a false positive.

The tester will need to have deep understanding what is malicious first of all, because that’s not something subjective and tied to interpretations, as well as sandbox tend to overblown and flag most files as malicious. So the tester will have to review the report, quickly and take a decision whether or not this actually is working malware.

Of course, someone like Leo won’t really do that.

Leo’s purpose is NOT to be informative and help the confused customer choose security solution (in an ocean of such). Leo’s purpose is to generate revenue through ads, sponsorships and through promoting not-so-amazing products like Sophos, without any actual evidence or explanation how exactly they are superior.

Long story short, don’t trust a youtuber to perform these highly technical tasks and tell you the truth.
If he was so professional, he wouldn’t be a youtuber.

Doing things “to the best of your ability” is one, doing it to the required, professional standard is something else.

 

[Andy Ful]

The tester will need to have deep understanding what is malicious first of all, because that’s not something subjective and tied to interpretations, as well as sandbox tend to overblown and flag most files as malicious. So the tester will have to review the report, quickly and take a decision whether or not this actually is working malware.

Of course, someone like Leo won’t really do that.

Leo’s purpose is NOT to be informative and help the confused customer choose security solution (in an ocean of such). Leo’s purpose is to generate revenue through ads, sponsorships and through promoting not-so-amazing products like Sophos, without any actual evidence or explanation how exactly they are superior.

Long story short, don’t trust a youtuber to perform these highly technical tasks and tell you the truth.
If he was so professional, he wouldn’t be a youtuber.

Doing things “to the best of your ability” is one, doing it to the required, professional standard is something else.

You know what I think about Leo's videotests. However, the matter is more complex.
The fact is that Leo has sufficient knowledge to recognize malware, even if sometimes there is little evidence of this in his videos.
Many professionals are also YouTubers. I found many interesting videos about fighting malware.
His videos primarily present his experiences based on his "testing" method. However, his "testing" method cannot be considered professional, solid, objective, or comprehensive. The testing results are most often statistically insignificant.

Anyway, the top AVs often score well in his videotests, so those videotests do not harm average users.

 

[Parkinsond]

You know what I think about Leo's videotests. However, the matter is more complex.
The fact is that Leo has sufficient knowledge to recognize malware, even if sometimes there is little evidence of this in his videos.
Many professionals are also YouTubers. I found many interesting videos about fighting malware.
His videos primarily present his experiences based on his "testing" method. However, his "testing" method cannot be considered professional, solid, objective, or comprehensive. The testing results are most often statistically insignificant.

That is why I stated previously "we need both lab test results and real-life feedback"; when enormous feedback contradicts lab test results, I consider such results with caution; the possibility of defective methodology exists.

 

[Andy Ful]

That is why I stated previously "we need both lab test results and real-life feedback"; when enormous feedback contradicts lab test results, I consider such results with caution; the possibility of defective methodology exists.

Yes. Although Leo's videotests do not contradict lab test results (even the videotest from the OP).

Here is an example. The professional tests show the average life expectancy in Western countries (explained and documented in the testing methodology).
Leo's video tests often show the average life expectancy in a random country, and conclusions are extended to the whole world.

 

[Parkinsond]

Yes. Although Leo's videotests do not contradict lab test results (even the videotest from the OP).

If I plan to promote a product (or the reverse), it is smart enough to not contradict well-known lab test results, unless I intend to lose credibility.

 

[Andy Ful]

If I plan to promote a product (or the reverse), it is smart enough to not contradict well-known lab test results, unless I intend to lose credibility.

You do not need to be smart. It is hardly possible to contradict professional tests in a short videotest (no matter what you do).

 

[Trident]

The fact is that Leo has sufficient knowledge to recognize malware, even if sometimes there is little evidence of this in his videos.
Many professionals are also YouTubers.

As a side effect of doing “testing” for many years (now probably 10+), Leo may have acquired some skills, as well as he may have received certain qualifications.

Bit his main objective is this (from his website):

Our audience includes CISOs, industry professionals, analysts, researchers, students and home users, with over 500,000 subscribers and 50M views worldwide.

We offer targeted, organic integrations with royalty-free access to the created content for £4K per video. This includes custom use for advertising purposes. This is recommended for cybersecurity vendors who want a detailed showcase of their product capabilities.

We also offer simpler sponsor segments, 1 min long towards the end of a video for £2K per video.

We typically offer custom playlist links, discounts when booking a large number of sponsor segments and prefer long-term partnerships. This is because YouTube views are unpredictable and longer term partnerships lead to much better results especially for the sponsor in terms of ROI.

Note: We require full invoice payment to complete the booking process and operate on an first come, first serve basis. Sponsor segments are generally booked out for 2-3 months in advance.

Emphasis on viewers and subscribers.
Personal opinions such as “the best”, “the worst”, “the most premium and professional”, not really furnished with any credible proof.
That’s what I see in his videos and nothing else.

 

[Andy Ful]

Emphasis on viewers and subscribers.
Personal opinions such as “the best”, “the worst”, “the most premium and professional”, not really furnished with any credible proof.
That’s what I see in his videos and nothing else.

Many people see the same, and many can see more. But everyone sees what he/she wants to see.

Post edited.