What are the chances that someone looking for WinRAR will type the following into the bowser address bar: http://www.winrar.com (link deactivated)? Probably millions have done this at one time, the official site is http://www.rarlab.com/.

Anyone going to http://www.winrar.com will be redirected to a French site, when they try to click on the “Free Software Downloads” button. There are 11 copies of WinRAR on this site and all 11 are infected with TROJ_STARTPA.QC.

SOURCE: TrendLabs Malware Blog: A WinRAR-lose situation.