If the machine is untrusted, it should not be connected to the network. If you know that it could have malware on it and are unsure of the actual malwares, connecting it to the network could open unknown breaches to attackers: what if it can act as a relay by opening one connection to a rogue site and having the attacker inside your network? What if it contains rootkits hiding under common names?
If you only need to extract a limited number of files, a possible way if to pass through a clean box:
- setup a machine with as few software as possible but holding the best anti-maware you can install on it
- extract the files you want to use from the possibly compromised machine on a just formatted removable media
- mount that media on the clean box and control that no known malware is detected - of course if something is detected the clean box should immediately be fully erased and re-installed from scratch.
From that point, you cannot be sure that the media does not contain harmfull content, but at least you have done your best to detect it. You will have to balance between the risk of undetected malware (should be low if you used good reputation tools on the clean box), the value of the extracted files, and the sensitiveness of other elements on the network (only you hollidays photos or nuclear weapon codes?)? The good old risk/gain balance...