Yes. Just having a file on your hard drive does nothing.
However, note that there may be potential for execution. Suppose the exploit was inside a .pdf, and opening it by a vulnerable reader results in code execution. It is possible that although you don't open it in your pdf viewer, just by opening its folder a plugin intended to create a thumbnail opens and parses the pdf… and infects you. Or you are running an automatic indexing process, that tries to parse the pdf, leading to the infection.
This is quite uncommon, as exploits are usually particular to a specific program, and it's more likely that you use a different reader and thus don't execute the exploit that you inadvertenly run it by using something other than the reader they were trying to infect (however the same software may be providing the viewer and the plugin…). But although unlikely, inadvertent execution by unknown pieces in your software stack is a risk to take into account.
Another class of attacks would be based on files with some names being special for some programs.
A file named .profile
would be harmless on Unix unless you happen to put it in your home folder. Then the shell will happily run it on next login (this is what made user-controlled filenames CVE-2010-2252).
Under certain conditions, it is possible that a .dll
you extracted will get run if you then open from that same folder a program that uses a dll with that same name.
.exe
extension, though. – KnightOfNi Oct 16 '14 at 22:09