# Can a .docx be a virus? **URL:** \ **Category:** Factual Questions\ **Created:** [December 7, 2013, 10:23am UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742 "2013-12-07T10:23:44Z")\ **Posts on this page:** 15\ **Page:** 2
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [December 9, 2013, 7:19pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/21 "2013-12-09T19:19:31Z")
> [@Ximenean](#): > > To put it another way, any file can be “executable” if the program that opens it is designed to interpret its contents as instructions. All programs interpret the data files that they use. If you format the data in the file in a way that the programmers didn’t think of you may be able to exploit bugs in programs to allow you to execute code. Text editors are generally meant to work with arbitrary files so you probably won’t find an exploit for wordpad. There have been exploits for things like MP3 players and picture viewers. ---
**Author:** ![Claverhouse](https://avatars.discourse-cdn.com/v4/letter/c/13edae/32.png) [@Claverhouse](https://boards.straightdope.com/u/Claverhouse)\ **Post date:** [December 9, 2013, 10:30pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/22 "2013-12-09T22:30:37Z")
> [@Budget\_Player\_Cadet](#): > > …what about audio/visual files? Whilst one may not _be_ a virus, it may _include_ a virus. .avis, .mp4, .mkvs, .movs etc. are naturally merely containers for codecs. There’s a legend — doubtful to me — that anti-torrent organizations not only put up fake torrents to catch IP addresses ( which they do ), but they also sometimes include malware. To discourage torrenting. Anyway, I once downloaded a short ( say, 5 minutes ) video, and it sprinted across the screen in 20 seconds and merely showed an image. Had I been using Windows I would have been alarmed. Checks showed that it was malware. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [December 10, 2013, 5:18am UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/23 "2013-12-10T05:18:44Z")
So if it’s a docx (and doesn’t contain macros) or you disable macros, are there any other known exploits, or is it safe to open such files? > [@drewtwo99](#): > > I always display file extensions, and it is also the very first thing I do after doing a fresh windows installation. Why windows hides file extensions by default, I will never understand. It’s just my theory, but I observe that OS X actually supports files without any extension… ---
**Author:** ![Mogle](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mogle/32/12021_2.png) [@Mogle](https://boards.straightdope.com/u/Mogle)\ **Post date:** [December 10, 2013, 10:58am UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/24 "2013-12-10T10:58:57Z")
> [@AaronX](#): > > It’s just my theory, but I observe that OS X actually supports files without any extension… Pre-OS X Mac OS didn’t use file extensions at all, but used something called [type code](http://support.apple.com/kb/TA25699) which was a part of the file meta data instead. ---
**Author:** ![Leo\_Bloom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/leo_bloom/32/10377_2.png) [@Leo\_Bloom](https://boards.straightdope.com/u/Leo_Bloom)\ **Post date:** [December 10, 2013, 5:35pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/25 "2013-12-10T17:35:19Z")
> [@Doughbag](#): > > …any file type can contain a virus Including mp3 or other media files? That’s the word on the street for the legions of people who “share” via BitTorrent. ---
**Author:** ![Doughbag](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@Doughbag](https://boards.straightdope.com/u/Doughbag)\ **Post date:** [December 10, 2013, 6:25pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/26 "2013-12-10T18:25:56Z")
> [@Mangetout](#): > > Whilst I agree with (what I think is) the thrust of your statement (that file extension is no reliable metric of safety or otherwise), can something like a plain text file contain a virus? Have you heard of such a thing? > > I guess if ‘contain’ is taken in its most literal, bland meaning, a text file can contain a the code of a virus, but it’s not going to be infectious in that state. If the file is a plain text file, it’s a plain text file. If the file pretends to be a plain text file and contains a virus – well, it has a virus in it, no matter what the extension says it is. > [@Leo\_Bloom](#): > > Including mp3 or other media files? > That’s the word on the street for the legions of people who “share” via BitTorrent. LOL… yes, including them files … However, being an mp3 files does not mean that it’s a virus ---
**Author:** ![Doughbag](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@Doughbag](https://boards.straightdope.com/u/Doughbag)\ **Post date:** [December 10, 2013, 6:33pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/27 "2013-12-10T18:33:49Z")
> [@AaronX](#): > > So if it’s a docx (and doesn’t contain macros) or you disable macros, are there any other known exploits, or is it safe to open such files? > > It’s just my theory, but I observe that OS X actually supports files without any extension… Mac needs them too, it just does it differently. [Link](http://www.fileinfo.com/help/mac_no_extension) [Link](http://en.wikipedia.org/wiki/File_format) ---
**Author:** ![brettster55](https://avatars.discourse-cdn.com/v4/letter/b/8491ac/32.png) [@brettster55](https://boards.straightdope.com/u/brettster55)\ **Post date:** [December 10, 2013, 7:38pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/28 "2013-12-10T19:38:40Z")
I would be cautious ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [December 10, 2013, 8:42pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/29 "2013-12-10T20:42:54Z")
As to media file types and viruses. Sometimes programs that decode these files are found to have errors which can be exploited. A classic example was the old form of uncompress used in LZW compression. There was a mistake in the stack handling and this was exploited. A lot of file formats use LZW encoding, e.g., gif. And furthermore, a lot of the programs that handled these formats used the same code since it was freely available. Several MS compression libraries were affected by this as well. Updates were eventually rolled out but no doubt there are a lot of people with older versions of some apps still around. If they open the wrong gif file, oops. And that’s a simple static media format. Audio and video files are much trickier to handle, the code is more complex, there are more opportunities for software errors to occur, etc. Some media files are exploitable by more direct ways. E.g., some MS video encodings allow people to embed links to web sites inside them, so that when you play the video, a link is opened to that web sites. Holy freaking moly is that a bad idea to allow that by default. And anything made in any Adobe media format should be assumed to be dangerous. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [December 10, 2013, 10:25pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/30 "2013-12-10T22:25:49Z")
> [@AaronX](#): > > So if it’s a docx (and doesn’t contain macros) or you disable macros, are there any other known exploits, or is it safe to open such files? Here’s a recent exploit: > **[Enterprise Cybersecurity Solutions, Services & Training | Proofpoint US](https://www.proofpoint.com/us)** > > Proofpoint helps protect people, data and brands against cyber attacks. Offering compliance and cybersecurity solutions for email, web, cloud, and more. I think I also remember reading about a DOCX XML one (different from above) in the past. ---
**Author:** ![Duke\_of\_York](https://avatars.discourse-cdn.com/v4/letter/d/f6c823/32.png) [@Duke\_of\_York](https://boards.straightdope.com/u/Duke_of_York)\ **Post date:** [December 10, 2013, 10:39pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/31 "2013-12-10T22:39:58Z")
Has anyone tried any of these programs to avoid virus’s installing on their PC? I find that deepfreeze can be a PITA but sandboxie is a good idea to have when downloading dodgy files. > **[Sandboxie (Read Only)](https://community.sophos.com/sandboxie/)** > > Sandboxie (Read Only) > **[Deep Freeze](https://www.deepfreeze.com.au/)** > > Absolute Workstation Integrity 100% Restore on every reboot ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [December 11, 2013, 3:48am UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/32 "2013-12-11T03:48:02Z")
> [@Doughbag](#): > > Mac needs them too, it just does it differently. > [Link](http://www.fileinfo.com/help/mac_no_extension) > [Link](http://en.wikipedia.org/wiki/File_format) I mean it can identify files without extensions just fine, or it hides extensions from the user. ---
**Author:** ![Doughbag](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@Doughbag](https://boards.straightdope.com/u/Doughbag)\ **Post date:** [December 11, 2013, 3:35pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/33 "2013-12-11T15:35:39Z")
> [@AaronX](#): > > I mean it can identify files without extensions just fine, or it hides extensions from the user. Not seeing the extensions in Windows by default is basically the same – Windows seems to just open the file magically with the right program. When you save your file on your Mac for your own Mac, the program/computer will most likely remember what file it is. When you are sending that file with no extension (and hidden tags/index), chances are the other person cannot open the file at all – all depending on what type of file it is. However, since many file types are just “zip” files in disguise with various extension. The extension is there, so the file goes straight to the program you want the file to be associated with and open with, eg.: \*.Mpg with Windows Media player, \*.mkv with VLC player, \*.avi with Media Player Classic. So, a Mac needs extensions as well, if the saved file type is not a “zip” file. ---
**Author:** ![RitterSport](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rittersport/32/6326_2.png) [@RitterSport](https://boards.straightdope.com/u/RitterSport)\ **Post date:** [December 11, 2013, 3:45pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/34 "2013-12-11T15:45:01Z")
> [@Mangetout](#): > > File extensions hardly matter. An executable payload could be renamed with the .docx extension, and depending on the configuration at the receiving end, the mail client, or browser, or OS may helpfully try to treat it as what it _is_, rather than what it is called. > [@Mangetout](#): > > Whilst I agree with (what I think is) the thrust of your statement (that file extension is no reliable metric of safety or otherwise), can something like a plain text file contain a virus? Have you heard of such a thing? > > I guess if ‘contain’ is taken in its most literal, bland meaning, a text file can contain a the code of a virus, but it’s not going to be infectious in that state. These two statements seem to contradict each other. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [December 11, 2013, 4:42pm UTC](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742/35 "2013-12-11T16:42:19Z")
> [@Mangetout](#): > > I guess if ‘contain’ is taken in its most literal, bland meaning, a text file can contain a the code of a virus, but it’s not going to be infectious in that state. Viruses exploit holes in the program that loads that type of file (or related/called pgms), if notepad had a vulnerability due to the way it was coded, then a text file could have a virus, but notepad and loading text files is simple enough there may be no vulnerabilities. [Previous page](https://boards.straightdope.com/t/can-a-docx-be-a-virus/675742.md?page=1)