McAfee does not like Hawaii

GeneralLee01 · 2025-02-09T16:24:00-0500

Hi All,

I tested below file using VirusTotal , all seems ok

But still McAfee goes nuts when it sees this file after download. Viewing it online is ok but after downloading is is quarantined.

This is the culprit:

https://www.fotolip.com/wp-content/uploads/2016/05/Map-of-Hawaii-11.jpg

Since McAfee closed down their community I am asking it here. Is this file is really bad, or . . .? I suspect all is ok, especially because virustotal.com did not find anything.

antspants · 2025-02-09T17:29:17-0500

How can a JPG file contain a virus?

Image-processing software vulnerabilities: Attackers can exploit vulnerabilities in image-processing software to hide malware in images.
Macros, Javascript, and EXIF headers: Malware can be hidden in JPG files using macros, Javascript, and EXIF headers.
Steganography: Malware can be hidden in JPG files using steganography.

Now you can Google all that above.

antspants · 2025-02-09T17:35:26-0500

The other thing to cosider is that McAfee is useless (no offence) The community is gone? Not surprising to me but I’d be interested to know why.
Did John McAfee get to them all before he died?
I don’t have a protected environment to test that jpg at all.

neemobeer · 2025-02-09T17:53:51-0500

Malware can be embedded in any type of file. I have witnessed malware that exploited a flaw in rendering icons, so merely having explorer render the icon would cause it to execute.

Malware typically will either just be malware and rely on social engineering a person to get them to execute it or it can exploit a flaw in a system or software to allow it to execute often times with no user interaction.

No stego hits, no hidden binaries found, no suspicious strings. The only hit I had was for a yara rule "Big Numbers1" which is a fairly generic rule.

I would say this is a false positive on McAfee's part

antspants · 2025-02-09T18:03:32-0500

There is no threat by that name listed anywhere.

neemobeer · 2025-02-09T18:10:19-0500

If you mean BigNumbers, it's not a threat. It's just a yara rule that identifies large hex numbers in files that can be considered suspicious. I can't say if McAfee uses a signature db for some of it's threat detection but that is the most likely case for it flagging this file

GeneralLee01 · 2025-02-09T18:25:51-0500

antspants said:
How can a JPG file contain a virus?

Image-processing software vulnerabilities: Attackers can exploit vulnerabilities in image-processing software to hide malware in images.

Macros, Javascript, and EXIF headers: Malware can be hidden in JPG files using macros, Javascript, and EXIF headers.

Steganography: Malware can be hidden in JPG files using steganography.

Now you can Google all that above.

Thanks , but why would I google that ?

GeneralLee01 · 2025-02-09T18:27:06-0500

I opened it in paint, resized, resaved, and McAfee is happy

antspants · 2025-02-09T18:57:39-0500

GeneralLee01 said:
Thanks , but why would I google that ?

If you’re curious.

abactuon · 2025-02-10T02:16:54-0500

McAfee must be a descendant of Captain Cook.

GeneralLee01 · 2025-02-10T02:48:17-0500

abactuon said:
McAfee must be a descendant of Captain Cook.

Remember that the cook is the most important person on a ship !

McAfee does not like Hawaii

Well-known member

My Computer

Like a rolling drone.

My Computers

Like a rolling drone.

My Computers

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computer