There are many, many things that are not "executables" in the usual sense but could still carry / deliver malware. Here are just a few:
- Any kind of script, ranging from a batch file (.bat) on Windows to an NPM module.
- Any shortcut (.lnk) or desktop (.desktop) file.
- File formats with built-in programmability that can interact with the OS, such as MS Office documents that support macros (.doc / .docm / .xlsm / etc.).
- Any library file (.dll / .so), which contains executable code but is not itself executable as a program (no
- Literally any file, regardless of extension, that contains an executable and has the execute permission (if invoked directly, such as from a shell).
- Any archive file (.zip / .tar / etc.) that contains one of the above.
That's without even considering exploits, such as URIs that compromise a handler program, PDFs or HTML with JS that can break out of the sandbox, file-sharing programs with path traversal bugs that could be used to deliver malicious files to places you don't expect them, listening sockets (servers) that can't handle malicious packets, or so on. Then there's risks such as a malicious (or compromised) OS, malicious firmware, malicious hardware, and so on.
Again, this list is just the stuff off the top of my head and is NOT comprehensive. There is literally no way to say that a machine is 100% secure, and even if you had a magical virus scanner with 100% accuracy, and could scan literally every file on the disk (not just the executables), it still wouldn't be enough.