Any file can be named anything, but only some file types can actually run code. Understanding the difference is the quickest way to judge how risky a file is.
Risk by file type
| File type | Can it carry malware? | How |
|---|---|---|
.exe .scr .com .msi .bat .cmd .ps1 | High risk | These are programs or scripts. Running one gives it the same access you have. |
.js .vbs .hta .wsf .lnk | High risk | Script and shortcut files that Windows can execute directly; common in email attachments and archives. |
.docm .xlsm .pptm, older .doc .xls | Medium | Office macros (VBA). Microsoft Office now blocks macros in files from the internet by default, so attackers try to trick you into unblocking them. |
.docx .xlsx .pptx | Low to medium | Can't store macros, but can contain malicious links, embedded objects or exploits for unpatched Office versions. |
.pdf | Low to medium | PDFs can contain JavaScript, embedded files and links, and have been used to exploit vulnerable PDF readers. Phishing PDFs that link to fake login pages are far more common. |
.zip .rar .7z .iso .img | Container | Not dangerous by themselves, but often used to deliver the high-risk types above. See scanning ZIP files. |
.jpg .png .gif .webp | Very low | Images are data, not code. The rare real risk is a bug in the software that decodes them, such as the 2023 libwebp vulnerability (CVE-2023-4863) that browsers patched urgently. |
.mp3 .mp4 .mkv .wav | Very low | Same as images: dangerous only through player bugs, or when the "video" is really an executable. |
.txt .csv .gpx .xml | Very low | Plain text. A CSV can carry spreadsheet formulas that run when opened in Excel ("CSV injection"), so heed Excel's security warnings. |
The real danger: disguised files
Most "infected PDFs" and "virus pictures" people encounter are not PDFs or pictures at all. They are executables named document.pdf.exe with a PDF icon, or shortcut (.lnk) files dressed up as folders. Windows hides known file extensions by default, so turn on View > Show > File name extensions in File Explorer.
Office documents and macros
If a Word or Excel file shows a yellow bar asking you to Enable Content or Enable Editing and the document text says you must do so to "view the document", close it. Legitimate invoices, CVs and contracts do not need macros. Office's Protected View opens internet files read-only for exactly this reason.
Other file types people ask about
- AutoCAD (.dwg): the drawing itself is rarely a threat, but malicious AutoLISP files (such as
acad.lsp) placed beside drawings have historically spread between machines. Modern AutoCAD's SECURELOAD setting restricts where such code can load from. - Game and project files (for example Roblox
.rbxlx, mod packs): these can include scripts that run inside the game or editor. Only use files from creators you trust. - USB drives, MP3 players and SD cards: modern Windows no longer auto-runs programs from USB drives, so plugging one in is not enough on its own. Scan the drive with Defender before opening files from it.
- Access databases (.accdb/.mdb): can contain VBA macros, so treat them like macro-enabled Office files.
How to open a suspicious document safely
- Check it first with the iMalware scanner (no upload, so it is safe for private documents).
- Keep Office, your PDF reader and your browser up to date.
- Preview it in the browser (Chrome, Edge and Firefox have built-in PDF viewers) rather than a full desktop application.
- Never enable macros on a document you didn't expect.
Frequently Asked Questions
Can a PDF contain a virus?
Yes, although it is less common than people fear. PDFs can contain JavaScript, embedded files and links, and have been used to exploit vulnerable PDF readers. Keeping your reader updated and opening unexpected PDFs in a browser viewer greatly reduces the risk.
Can a JPG or PNG image contain a virus?
An image cannot run by itself. The rare danger is a bug in the software that displays it, which is why browser and operating-system updates matter. A file that only looks like an image, such as photo.jpg.exe, is the far more common trick.
Can a Word document have malware?
Yes, mainly through macros. Microsoft Office blocks macros in files from the internet by default. If a document insists you enable content or macros to read it, close it.
Is it safe to open a file in Notepad to see what it is?
Yes. Notepad only displays the file's contents as text and does not execute it.