Avoiding mouse cursor viruses

Log-in or register.

How to avoid a cursor virus

Since you are reading this page, you have probably heard that using a custom mouse cursor may infect your computer with malware. While there is a small danger associated with actual cursor files (discussed later), the real danger lays in malicious web sites that pretend to offer custom cursors, but their real agenda is different.

There are 3 simple rules that will protect you from malware disguised as cursors:

  1. Only download cursors from trustworthy sites. When you asses a web site, do not ask its owner whether it is safe - the answer will always be yes and you will learn nothing. Instead ask elsewhere on the web or search for "site name" and "virus", "adware" or "malware" on Google. Be aware that web sites and their owners and policies may change in time - always be alert.
  2. Never run or install anything when downloading cursors. Cursors are data files, not applications. While there may be applications that simplify cursor changing, these are optional and should never be bundled with the actual cursors.
  3. Keep your computer updated. The single known vulnerability related to animated cursors was fixed years ago, but if a new one is discovered and fixed, you want to have the fix as soon as possible.

Concrete dangers associated with mouse cursors

While following the above rules is enough to protect yourself, it never hurts to learn more details. Here they come.

.CUR and .ANI files

First, let's look at the standard Windows cursor files. There are 2 kinds: normal cursors (with .cur extension) and animated cursors (with .ani extension).

These cursor files are data files, similarly as .png or .jpg images or e-books. Data files are usually safe - you can download and copy them around without fear. They can only be dangerous indirectly - when the application that uses the files contains an exploitable security hole. There used to be a security hole in Windows, but it has been fixed years ago. Keeping your Windows updated takes care of this problem.

Let me say a few words about anti-virus software. When the security problem with .ani files in Windows was published years ago, anti-virus manufacturers updated their products to recognize the suspicious .ani files. Some of then did a very sloppy job and valid .ani files were incorrectly flagged as viruses. If your anti-virus software warns you about an .ani file, open it in RealWorld Cursor Editor and re-save it. If the warning does not go away, contact your anti-virus provider and report this "false positive" to them.

.ZIP or .RAR files

.zip or .rar files are compressed archives containing multiple files. Before these files can be used, they must be extracted to a folder. These archives should contain .cur or .ani files and possibly some accompanying files. Focus on the .ani and .cur files, be suspicious about the other files - never run any applications that were extracted together with the cursors. Some archives may contain an .inf file that can help you install and activate the cursor files. Although the .inf file may be very handy, it can also be very dangerous. I would not recommend you to use it if it came from a untrustworthy source.

Other kinds of files

This is where the real danger lays. There are malicious web sites that pretend to offer custom mouse cursors, but instead attempt to install malware or adware on the computers of their unsuspecting visitors.

Fortunately, protecting from these kind of attacks is not hard. Use an updated web browser. Never "run" or "install" anything. Always look for .cur or .ani file (or .zip archives) and "save" them when asked (activate them via Control Panel or a specialized tool). If a web site does not offer you to download .cur or .ani files directly (or indirectly in a .zip file) and instead forces you to install something, leave as quickly as possible.

How trustworthy is a web site?

Assessing the level of trustworthiness of a web site is not trivial. Looks can be deceiving.

Positive factors:

  • Age of a web site.
  • Amount of content.
  • Consistent look and feel of the web site.
  • Owner can be easily contacted.

Negative factors:

  • Too many ads.
  • Promises something that is too good to be true.
  • Searching for the site name and "virus", "adware", "spyware" or "malware" on Google brings too many warnings on more trustworthy sites.

Recent comments

- show all comments
user icon Anonymous on October 27th 2014

Hey this is quite helpful! My friend makes viruses but I've never seen one that is not a .exe so THIS TELLS YOU THE No.1 RULE: Only open .cur/.ani files!

user icon Anonymous on August 11th 2015

:-) i am glad this website has info about viruses on cursor sites now i will be more careful downloading cursors thanks for the help thumbs up!

user icon Anonymous on October 7th 2015

What? I don't know what you guys are talking about but okay if you guys say that this is good, I vote for this being good too |-) Just trying to be cool.. Anyways

user icon Anonymous on October 18th 2015

Good article, and what a great website! Thank you! :-)

user icon Anonymous on January 21st 2016

thanks for having this information available to us. Very informative. 8-)

user icon Anonymous on February 12th 2016

My sister told me not to download cursors, but I know the ones I download aren't viruses so I do it anyways >:D

user icon Anonymous on March 15th 2016

Thanks for the post. But if i set my cursors in .ani or .cur and i restart my computer the cursor resets to the normal shape. S :-( omeone can help me not pass that?

user icon Anonymous on July 21st 2016

Saving cursors that you strongly trust into your computer's default cursor-containing folder, that cursor will be able to be used as soon as the computer starts (or whenever you log in). In Windows 7 it's under Local Disc> Windows> Cursors.

user icon Anonymous on October 21st 2016

is it ok to download from here

user icon Anonymous on November 12th 2016

Thanks! Now I don't have to worry more about viruses! :-D

user icon Anonymous
Vista & Win 7 icons
I wish there were...
Select background