Serious Discussion Quick Play with McAfee

[Trident]

The analysis and play with McAfee continues. Today's work reveals that McAfee is using memory content scan: it is capable of scanning the underlying process code, as opposed to just getting the image path and scanning it on disk.

Some of these threats were taken from real attacks and copy-pasted in PowerShell. Others have extremely low VT detection.

VirusTotal

VirusTotal

www.virustotal.com

Field	Value
Timestamp(s)	7:05 PM, 7:14 PM, 7:15 PM
Action Taken	Infected (Detected in Memory)
Target	[memory] PowerShell.exe
SHA256 Hash	N/A (Memory Scan)
TLSH	N/A
Key Engines	rp-fileless (50, 50, 45), neo (50, 50, 1)

Field	Value
Timestamp	2025-07-28 at 7:11:45 PM BST
Action Taken	Infected (Behavior Blocked)
Target	C:\...\aspnet_compiler.exe
SHA256 Hash	923c541ce782bf45a3d338487e6f411cd11ab0b98eb9775a2d2065dff39a4f37
TLSH	Not Provided
Engines	rp-d (1), cache (99)

Field	Value
Timestamp	2025-07-28 at 7:18:02 PM BST
Action Taken	Infected (Behavior Blocked)
Target	C:\...\certutil.exe
SHA256 Hash	0693b1964ce3e578d61cbe1d7dec28737cad29147d89fe6fe537dd591a0a68bb
TLSH	Not Provided
Engines	rp-d (1), cache (99)

Field	Value
Timestamp	2025-07-28 at 7:18:05 PM BST
Action Taken	Infection Quarantined
Target	C:\Users\user\AppData\Local\Temp\pipe\XORLoader.ps1
SHA256 Hash	b9b34908dd298d8a43b2306f81370bf9af0c9e49a8c33110b021f2739c0b58b2
TLSH	Not Provided
Engines	signature (50), av (50), neo (50)

 

[Bot]

Thank you for sharing your detailed analysis on McAfee's memory content scan. It's interesting to see how it's capable of detecting threats in real-time, even in the underlying process code. The fact that it can handle threats from real attacks and those with low VT detection is impressive. The tables you provided give a clear picture of the actions taken, targets, and engines involved. This will be helpful for others in understanding McAfee's capabilities.

 

[Szellem]

The analysis and play with McAfee continues. Today's work reveals that McAfee is using memory content scan: it is capable of scanning the underlying process code, as opposed to just getting the image path and scanning it on disk.

Some of these threats were taken from real attacks and copy-pasted in PowerShell. Others have extremely low VT detection.

VirusTotal

VirusTotal

www.virustotal.com

Field	Value
Timestamp(s)	7:05 PM, 7:14 PM, 7:15 PM
Action Taken	Infected (Detected in Memory)
Target	[memory] PowerShell.exe
SHA256 Hash	N/A (Memory Scan)
TLSH	N/A
Key Engines	rp-fileless (50, 50, 45), neo (50, 50, 1)

Field	Value
Timestamp	2025-07-28 at 7:11:45 PM BST
Action Taken	Infected (Behavior Blocked)
Target	C:\...\aspnet_compiler.exe
SHA256 Hash	923c541ce782bf45a3d338487e6f411cd11ab0b98eb9775a2d2065dff39a4f37
TLSH	Not Provided
Engines	rp-d (1), cache (99)

Field	Value
Timestamp	2025-07-28 at 7:18:02 PM BST
Action Taken	Infected (Behavior Blocked)
Target	C:\...\certutil.exe
SHA256 Hash	0693b1964ce3e578d61cbe1d7dec28737cad29147d89fe6fe537dd591a0a68bb
TLSH	Not Provided
Engines	rp-d (1), cache (99)

Field	Value
Timestamp	2025-07-28 at 7:18:05 PM BST
Action Taken	Infection Quarantined
Target	C:\Users\user\AppData\Local\Temp\pipe\XORLoader.ps1
SHA256 Hash	b9b34908dd298d8a43b2306f81370bf9af0c9e49a8c33110b021f2739c0b58b2
TLSH	Not Provided
Engines	signature (50), av (50), neo (50)

Thanks for sharing this, bro! Now I'm even happier that I invested in McAfee at the end of the week. It was a good decision. I'm satisfied, even though I was a Kaspersky user for 21 years.

 

[nickstar1]

Trident over here getting everyone to switch to mcafee lol even me.​

 

[stonjean633]

Trident over here getting everyone to switch to mcafee lol even me.​

Trident's marketing is top notch....hehe

 

[Miravi]

Keep up the excellent work. I'm always grateful, and it's just what this community needs.

At first trying McAfee I thought, "It's fine, but is this really my style?" It's definitely grown on me with time.

 

[Digmor Crusher]

Trident over here getting everyone to switch to mcafee lol even me.​

Which shows how fickle this forum can be as it wasn't that long ago when almost everyone here hated it.

 

[nickstar1]

Which shows how fickle this forum can be as it wasn't that long ago when almost everyone here hated it.

A good reason why people need to stop living in the past if history has showed us one thing companies do innovate and every year there could be a rising star of a software company.

 

[Jonny Quest]

Which shows how fickle this forum can be as it wasn't that long ago when almost everyone here hated it.

I'm not sure about the word fickle, but maybe with the changes McAfee has made, the reviews, the feedback from the members, along with this thread, it's being done more out of insight?

But yes, it had a hard reputation to overcome, and maybe still does with some. And I admit it, when I got my Dell notebook (even with the HP notebook) that was the first thing I uninstalled, whatever version of McAfee it was.

 

[Jonny Quest]

A good reason why people need to stop living in the past if history has showed us one thing companies do innovate and every year there could be a rising star of a software company.

And, some companies regress.. cough, cough...my beloved F-Secure

 

[anirbandutta01]

The analysis and play with McAfee continues. Today's work reveals that McAfee is using memory content scan: it is capable of scanning the underlying process code, as opposed to just getting the image path and scanning it on disk.

Some of these threats were taken from real attacks and copy-pasted in PowerShell. Others have extremely low VT detection.

VirusTotal

VirusTotal

www.virustotal.com

Field	Value
Timestamp(s)	7:05 PM, 7:14 PM, 7:15 PM
Action Taken	Infected (Detected in Memory)
Target	[memory] PowerShell.exe
SHA256 Hash	N/A (Memory Scan)
TLSH	N/A
Key Engines	rp-fileless (50, 50, 45), neo (50, 50, 1)

Field	Value
Timestamp	2025-07-28 at 7:11:45 PM BST
Action Taken	Infected (Behavior Blocked)
Target	C:\...\aspnet_compiler.exe
SHA256 Hash	923c541ce782bf45a3d338487e6f411cd11ab0b98eb9775a2d2065dff39a4f37
TLSH	Not Provided
Engines	rp-d (1), cache (99)

Field	Value
Timestamp	2025-07-28 at 7:18:02 PM BST
Action Taken	Infected (Behavior Blocked)
Target	C:\...\certutil.exe
SHA256 Hash	0693b1964ce3e578d61cbe1d7dec28737cad29147d89fe6fe537dd591a0a68bb
TLSH	Not Provided
Engines	rp-d (1), cache (99)

Field	Value
Timestamp	2025-07-28 at 7:18:05 PM BST
Action Taken	Infection Quarantined
Target	C:\Users\user\AppData\Local\Temp\pipe\XORLoader.ps1
SHA256 Hash	b9b34908dd298d8a43b2306f81370bf9af0c9e49a8c33110b021f2739c0b58b2
TLSH	Not Provided
Engines	signature (50), av (50), neo (50)

Thank you for sharing your detailed analysis @Trident . I'll try McAfee. I'm currently using ESET & also Kaspersky & K7 are my all time favourite.

 

[jtshadow92]

Everyone makes jokes on McAfee, but they have been making huge moves in the background. I remember when they tested their cloud only based protection back when McAfee Gamer Security came out. Took a while to get here, but I am super happy we went from 15 processes down to 4 (the most). I just wish they would make a dark mode theme cause that bright white theme blinds me at night.

 

[Jonny Quest]

Everyone makes jokes on McAfee, but they have been making huge moves in the background. I remember when they tested their cloud only based protection back when McAfee Gamer Security came out. Took a while to get here, but I am super happy we went from 15 processes down to 4 (the most). I just wish they would make a dark mode theme cause that bright white theme blinds me at night.

15 processes previously, that's BD territory. Will it go into dark mode if you change the Windows 11 theme to Dark? But yes, it's always nice to have that option within the app itself.

 

[Harputlu]

Which shows how fickle this forum can be as it wasn't that long ago when almost everyone here hated it.

I still hate it.

 

[Digmor Crusher]

I'm not sure about the word fickle,

changing frequently, especially as regards one's loyalties, interests, or affection.

 

[piquiteco]

15 processes previously, that's BD territory. Will it go into dark mode if you change the Windows 11 theme to Dark? But yes, it's always nice to have that option within the app itself.

If you are talking about BD, then dark mode follows the system default or you can change it in the BD GUI. But McAfee does not have dark mode, the GUI is all white, and that doesn't bother me because the GUI is simple and intuitive, and you don't interact with it much all the time. McAfee comes with a default gold configuration, so you don't need to do any configuration. You install the product and forget about it, you just configure it to enable VPN on unsecured Wi-Fi networks, that's it, McAfee has zero settings. I liked that, users with a certain level of advanced knowledge may not like it. But for me, the most important thing is the efficiency in detecting and neutralising malware, McAfee protecting me from these pests and keeping my machine clean is great.

 

[Jonny Quest]

changing frequently, especially as regards one's loyalties, interests, or affection.

This is what I had in mind in my post, that they weren't changing as in the definition below, but out of new knowledge and insight. But, we all can get a little giddy here at times and play the AV roulette wheel

fickle

1. likely to change your opinion or your feelings suddenly and without a good…

dictionary.cambridge.org

Likely to change your opinion or your feelings suddenly and without a good reason.

 

[Moonhorse]

I guess its fine to swap antiviruses as often you like to, and favour the one doing ''best''

Mcafee got new cloud version and improved alot in short time
meanwhile f-secure downgraded to avira clone in same time
I mean that things happens in short period, someone can totally surprise with success and other can just flop badly, but there are some products like kaspersky that has done good in long period, and probably is rated high because of that ( it has gained trust being good as long term) meanwhile mcafee been worst for years and probably has worst reputation, so noone thinks its good choice and couldnt change, but it seems they can improve and by alot

Its good we have @Trident and many other members that try out these not so often used antiviruses, it would get boring to just test and promote same top 3 antiviruses constantly

 

[rashmi]

I'm not sure about the word fickle

changing frequently, especially as regards one's loyalties, interests, or affection.

Likely to change your opinion or your feelings suddenly and without a good reason.

Fickle (formal)... You're sophisticated beyond our comprehension; we're just not refined enough to appreciate your ever-changing preferences!

Fickle (informal)... is like ordering a salad and then stealing fries!

 

[Trident]

McAfee has zero settings

McAfee actually has a lot of settings, just not settings for the antivirus module.

When you go on protection.mcafee.com, there is quite a lot to setup.


Locally in the app, there are some settings here and there.

For example on the scanner window, there is scan speed selection, telemetry control and the option to shutdown the machine.
On the Web Advisor settings, there is exceptions, search result indicators on off, social network protection.

In the console, there are antivirus exceptions, firewall exceptions, VPN settings (like location, split tunnel and so on).

So there are still some personalisation and setup options, it’s just the typical heuristic aggression levels and so on have been omitted.