.PNG & .ICO safe to exclude ?

[ChicknDip]

Hi, since I work with a lot of .PNG & .ICO files, is there any known danger from these files ? Can they safely being excluded in the AMON module ?

Thanks for the help !

[Marcos]

I don't see any reason for excluding them. It absolutely doesn't slow down the computer.

[ChicknDip]

EXactly, I tried just for sake, but it indeed didn't make any difference.

Well , if you exclude *.exe files you'll definitely make a difference . At first your computer will be a little bit faster , then you'll get infected

[ChicknDip]

It's weird, but in my 10 years on computer I have yet to get the first virus on my system.

[Inspector Clouseau]

NOD has a proper filetype engine so all files which are not required to scan will be ignored anyway. The time you save from not reading the file headers to determine the file type is minimalistic and not worth the effort.

Another thing is that you can rename normal bitmap files to ico and that would represent a possibility of exploit risk if there is a new GDI exploit when you fully ignore this type of files.

[Proactive Services]

Originally Posted by ChicknDip

Hi, since I work with a lot of .PNG & .ICO files, is there any known danger from these files ? Can they safely being excluded in the AMON module ?

They most defintely can be a threat - the Windows Cursor exploit that hit earlier this year used PNG and ICO file types at some point, I believe. I wouldn't have thought that you would see much performance difference with them excluded anyway.