99% of all virus, malware, keyloggers and other forms of malicious software are injected into your machine by your own operation. In easy to explain terms; this means that you have to execute files yourself (.exe, .bat, .com, .reg etc. extensions are executable files) before your machine becomes infected. .VAR files do not have the possiblity of self execution, only through a program that fires them up (like VAM) and even then the files has to be written so that VAM surpasses defenses that your OS (Windows, Mac, etc.) has in place to prevent exactly these kind of things. It would take alot of time and a lot of effort for a coder/hacker to write up code that first fires through VAM AND then continues to infect your machine.
9 out of 10 times when someone tells on a forum that he/she has a postive virus report their own machine has been infected by another file, altogether, they use a virusscanner that itself fringes on malware or has an overactive heuristical database attached to their virusscanner that almost marks everything as a potential hazard.