Avoiding mouse cursor viruses

Log-in or register.

How to avoid a cursor virus

Since you are reading this page, you have probably heard that using a custom mouse cursor may infect your computer with malware. While there is a small danger associated with actual cursor files (discussed later), the real danger lays in malicious web sites that pretend to offer custom cursors, but their real agenda is different.

There are 3 simple rules that will protect you from malware disguised as cursors:

  1. Only download cursors from trustworthy sites. When you asses a web site, do not ask its owner whether it is safe - the answer will always be yes and you will learn nothing. Instead ask elsewhere on the web or search for "site name" and "virus", "adware" or "malware" on Google. Be aware that web sites and their owners and policies may change in time - always be alert.
  2. Never run or install anything when downloading cursors. Cursors are data files, not applications. While there may be applications that simplify cursor changing, these are optional and should never be bundled with the actual cursors.
  3. Keep your computer updated. The single known vulnerability related to animated cursors was fixed years ago, but if a new one is discovered and fixed, you want to have the fix as soon as possible.

Concrete dangers associated with mouse cursors

While following the above rules is enough to protect yourself, it never hurts to learn more details. Here they come.

.CUR and .ANI files

First, let's look at the standard Windows cursor files. There are 2 kinds: normal cursors (with .cur extension) and animated cursors (with .ani extension).

These cursor files are data files, similarly as .png or .jpg images or e-books. Data files are usually safe - you can download and copy them around without fear. They can only be dangerous indirectly - when the application that uses the files contains an exploitable security hole. There used to be a security hole in Windows, but it has been fixed years ago. Keeping your Windows updated takes care of this problem.

Let me say a few words about anti-virus software. When the security problem with .ani files in Windows was published years ago, anti-virus manufacturers updated their products to recognize the suspicious .ani files. Some of then did a very sloppy job and valid .ani files were incorrectly flagged as viruses. If your anti-virus software warns you about an .ani file, open it in RealWorld Cursor Editor and re-save it. If the warning does not go away, contact your anti-virus provider and report this "false positive" to them.

.ZIP or .RAR files

.zip or .rar files are compressed archives containing multiple files. Before these files can be used, they must be extracted to a folder. These archives should contain .cur or .ani files and possibly some accompanying files. Focus on the .ani and .cur files, be suspicious about the other files - never run any applications that were extracted together with the cursors. Some archives may contain an .inf file that can help you install and activate the cursor files. Although the .inf file may be very handy, it can also be very dangerous. I would not recommend you to use it if it came from a untrustworthy source.

Other kinds of files

This is where the real danger lays. There are malicious web sites that pretend to offer custom mouse cursors, but instead attempt to install malware or adware on the computers of their unsuspecting visitors.

Fortunately, protecting from these kind of attacks is not hard. Use an updated web browser. Never "run" or "install" anything. Always look for .cur or .ani file (or .zip archives) and "save" them when asked (activate them via Control Panel or a specialized tool). If a web site does not offer you to download .cur or .ani files directly (or indirectly in a .zip file) and instead forces you to install something, leave as quickly as possible.

How trustworthy is a web site?

Assessing the level of trustworthiness of a web site is not trivial. Looks can be deceiving.

Positive factors:

  • Age of a web site.
  • Amount of content.
  • Consistent look and feel of the web site.
  • Owner can be easily contacted.

Negative factors:

  • Too many ads.
  • Promises something that is too good to be true.
  • Searching for the site name and "virus", "adware", "spyware" or "malware" on Google brings too many warnings on more trustworthy sites.

Recent comments

- show all comments
user icon Anonymous on May 12th

Is this site safe tho

user icon Anonymous on June 7th

stan Perfume

user icon Anonymous on June 16th

is the website safe? google doesn't say anything this year

user icon Anonymous on June 23rd

I've just downloaded this cursor set (year 2020) haha

I'll come back to this post if I found any viruses.

If I don't I've been defeated by the virus :-D

user icon Anonymous on June 26th

yall i took one for the team and i haven't gotten any viruses so far

user icon not used anymore registered user on July 29th

Yes, this site it's trust-worthy. It's safe to download cursors here.

user icon Anonymous on August 8th

i really dont know, because i want a steven universe cursor, and im not sure if it is safe-

user icon Anonymous on August 30th

...So basically, i reccomend deviant art, its safe. i dont know i downloaded from this site and the cursor is in a zip file.. so idk.

user icon deathstarkitty registered user on September 8th

2020 here and so far, so good? :-o

user icon Anonymous on September 11th

Yeah all good

user icon Anonymous
Vista & Win 7 icons
What about ICL files?
I wish there were...