搞了一个样本，大家分析一下

lanvin

ArcaVir	1.0.4	HLL.Dropper_type	2.57127 secs
avast!	3.0.0	Clean	0.00513601 secs
AVG Anti Virus	7.5.45	Clean	2.00253 secs
BitDefender	7.1	Clean	4.07283 secs
CAT QuickHeal	9.00	Clean	4.83618 secs
ClamAV	0.90/3033	Clean	0.04126 secs
Dr. Web	4.33.0	Clean	7.74755 secs
F-PROT	4.6.7	Clean	0.703941 secs
F-Secure	1.02	Clean	0.0935159 secs
H+BEDV AntiVir	2.1.10-32	NULL	5.29243 secs
McAfee Virusscan	5.10.0	Univ/f.dr	1.39751 secs
NOD32	2.51.1	Clean	2.40039 secs
Norman Virus Control	5.70.01	NULL	6.21279 secs
Panda	9.00.00	Clean	1.19667 secs
Sophos Sweep	4.16.0	Clean	3.57462 secs
Trend Micro	8.310-1002	Clean	0.0122299 secs
VBA32	3.11.3	Clean	2.35748 secs
VirusBuster	1.3.3	Dropper.Natas.4988.AA	2.01122 secs

beat2

Begin scan in 'D:\work area\gr.rar'
D:\work area\gr.rar
  [0] Archive type: RAR
  --> Zombie.gr.exe
      [DETECTION] Contains signature of the batch virus BAT/Zombie.dr
      [INFO]      A backup was created as '46456625.qua'  ( QUARANTINE )
      [INFO]      The file was deleted!