Dangerous Files Don't Always End in .EXE — Here's What Else You Should Watch Out For
If someone told you to never open a suspicious .EXE file, congratulations — you've absorbed one of the most basic pieces of Windows security advice out there. But here's the uncomfortable truth: scammers already know you've heard that warning. And they've been quietly routing around it for years.
The .EXE extension is just one item on a much longer list of file types that can execute code on your computer. Some of them look completely innocent at first glance — a screensaver, a Windows installer package, or even what appears to be a plain text script. If you're only watching for .EXE, you're leaving a lot of doors unlocked.
Let's walk through what's actually going on.
Why File Extensions Matter (and Why Windows Hides Them)
Every file on your Windows PC has an extension — those letters after the dot in a filename that tell the operating system what kind of file it's dealing with. Your vacation photos end in .JPG. Your Word documents end in .DOCX. And programs you can run end in a variety of extensions, with .EXE being the most famous.
Here's the problem: Windows, by default, hides known file extensions from you. That means a file called invoice.pdf.exe might show up in your Downloads folder as simply invoice.pdf, complete with a PDF icon. You'd have no visual reason to be suspicious.
This is a feature Microsoft built in years ago to keep things looking tidy for everyday users. In practice, it's a gift to anyone trying to trick you into running malicious software.
The Other Extensions That Can Run Code
So beyond .EXE, what else should you know about? Here are some of the most commonly abused file types:
COM files (.COM) — One of the oldest executable formats around, dating back to the DOS era. Windows still runs them. Malware authors occasionally use .COM files precisely because people don't think of them as dangerous anymore.
Screensaver files (.SCR) — Surprise: screensavers are fully executable programs. A file ending in .SCR can do everything a .EXE can do. Attackers have used fake screensaver files for years, often distributing them as fun downloads or holiday-themed animations.
Windows Installer packages (.MSI) — These are the standard format for installing software on Windows, and your system is designed to run them automatically. Malicious .MSI files can install anything from ransomware to spyware, and because MSI is a legitimate, trusted format, some security tools give it less scrutiny.
PowerShell scripts (.PS1) — PowerShell is a powerful scripting language built into Windows, and .PS1 files are its scripts. Attackers love PowerShell because it can do an enormous amount of damage — downloading files, modifying system settings, disabling security software — all from what looks like a plain text file.
Batch files (.BAT) and Command scripts (.CMD) — Old-school but still effective. These are basically lists of commands for Windows to run. They won't look like programs, but they absolutely act like them.
JavaScript files (.JS) and VBScript files (.VBS) — Windows has a built-in scripting engine that can run these file types directly if you double-click them. Malicious .JS and .VBS files have been a staple of phishing email attachments for a long time.
HTA files (.HTA) — Short for HTML Application, these are HTML files that run with the same permissions as a local program rather than being sandboxed inside a browser. They're rare enough that most users have never heard of them, which is partly what makes them useful to attackers.
The Disguise Game: How Attackers Combine These Tricks
Knowing which extensions are dangerous is step one. Understanding how they get disguised is step two.
Beyond the hidden-extension trick mentioned earlier, scammers use a few other approaches. One is the right-to-left override character — a special Unicode character that reverses the order text is displayed. A file actually named malware_fdp.exe can be made to display as malware_exe.pdf using this trick. It's subtle, and it works.
Another common tactic is simply using convincing icons. Windows uses icons to help you identify file types at a glance, but any program can be given any icon. A .SCR file can be made to display a PDF icon. An .MSI file can look like a Word document. The icon tells you nothing you can actually rely on.
Email attachments and files downloaded from file-sharing sites are the most common delivery mechanisms. That "invoice" your fake FedEx notification is asking you to open? Worth a very careful look before you click.
How to Make Windows Show You the Truth
The single most effective thing you can do right now is turn off Windows' habit of hiding file extensions. Here's how:
- Open File Explorer (the folder icon in your taskbar).
- Click the View tab at the top.
- In Windows 11, click Show, then check File name extensions. In Windows 10, check the File name extensions box directly in the ribbon.
Once you do this, every file on your system will show its real extension. That fake PDF will reveal itself as a .EXE. That screensaver will be clearly labeled .SCR.
Beyond that, consider these habits:
- Don't open email attachments you weren't expecting, even from people you know. Their account may have been compromised.
- Be skeptical of anything that prompts you to "enable" something — macros in Office documents, scripts, active content. Legitimate files rarely need you to lower your guard to work.
- Keep Windows Defender or your security software updated so it has the latest definitions for known malicious files.
- Scan downloads before opening them, especially if they came from an unfamiliar source.
The Bottom Line
The .EXE extension has a bad reputation for a reason, but it's far from the only file type that can hurt your computer. Scammers are well aware that most people have been trained to fear .EXE — so they use everything else instead. Knowing the full picture, and taking five minutes to change one setting in File Explorer, puts you in a significantly stronger position than the average user. And on the internet, that difference matters.
