Let's say we got an infected JPEG image that just by viewing it can automatically execute the malicious code stored inside it. It can do this either by taking advantage of the image viewer's security holes using buffer overflow or other techniques. Is the only place to store the code ready for execution, inside the EXIF data segments of a JPEG image?
Assuming that someone uses the EXIFtool or FileMind QuickFix to remove all EXIF metadata. Would this clear the image from the code that could execute when viewing the image, thus removing the threat stored inside ?
PS: The image can be viewed and it is not for example a renamed *.exe file. We are not infected by another malware that can read using steganography techniques the code hidden in the images and execute it. We are clean and we just open the image.
EDIT: Case self-executing code can be stuffed inside the actual data of the image apart form EXIF metadata, this code can be detected. If it was encrypted, it would need another malicious program to decrypt it. So how can I detect this code inside the image ?