New virus currently favoring RAR

There is a new virus out which favors using RAR files. RAR files are a type of compression that isn't as standard on most user systems as say ZIP files are. Frequently it is used in warez (illegally copied software), but obviously not limited to that.

Many anti-virus systems don't look out for this type of file, hence the move towards it by the writers of this virus.

I have already updated the mailserver's anti-virus blocking rules on the Exchange 2003 server where I work - it now blocks RAR files both if they have that extension and also if they are mislabeled it checks the file type as well.

Do note that this doesn't mean in any way that all RAR files are going to have viruses. It is just something interesting to note and look out for.

Posted by Eric at February 21, 2005 05:09 PM | TrackBack