New Virus Attack Technique Bypasses Filters

Late last month, administrators and service providers began seeing virus-infected messages with a new type of attachment hitting their mail servers: an .rar archive.

The emergence of .rar-packed viruses highlights the lengths to which virus writers are willing to go to evade anti-virus systems, as well as the limitations of those traditional signature-based defenses.

Experts say .rar files carrying viruses have been sailing past commercial anti-virus products and finding their way into the mailboxes of users, who are often unfamiliar with the file format. Administrators who have seen .rar-packed malware say that none of the messages have been stopped by their anti-virus defenses.

"Most users have finally gotten trained not to open .zips and executables, and now we have to worry about this," said the administrator, who asked not to be identified. "Our [anti-virus system] doesn't catch these yet, so we have to block it at the gateway in order to stop them."