Trying to make distinctions like this gets you back to "figuring out how you were owned", i.e. determining the transmission vectors and threats. The reality is

Trying to make distinctions like this gets you back to "figuring out how you were owned", i.e. determining the transmission vectors and threats. The reality is that decoders for complex file formats often have buffer overrun and code execution flaws. If such mechanisms were used in the original attack or if the malware has worm-like abilities to extend the attack from your compromised machine, then wouldn't it me likely that more such corrupted data is also being staged to your machine? Also, a very real risk would be the huge number of little scripts and configuration files which offer embedded scripting syntaxes. A naive victim might think they can install a new OS and just "recover their custom configuration files", but they are really recovering the attacker's configuration which can include the actual malware activation or other fail-safe reinfection mechanisms.