That would be a reasonable assumption that the Win32:Evo-gen [Susp] signature has been tweaked.