Generic Malware.a!zip

Viruses and worms
1

Hello,
I am the email administrator for my company. We use Icewarp Mail Server (http://www.icewarp.com)(Latest Version). Icewarp Mail Server uses Avast as its Builtin Antivirus. We are being hit hard by a particular virus that is being identified by client computers running Mcafee as Generic Malware.a!zip. I contaced Icewarp support about this and they referred me to the Virus Incident Report Form here: http://www.avast.com/eng/virus-incident-report.php However, this link had no place to upload the virus. What would fit my needs is to get the virus added to the Avast Virus Definitions. What is the proper method? I would like to have my mail server’s avast properly detect and delete the virus from email messages as it does the other thousands of viruses we receive per day.

Thanks,
TAshbaugh

Information Below Cut and paste from http://www.virustotal.com/

File Statement_January-October.zip received on 10.21.2008 20:14:22 (CET)
Current status: finished
Result: 24/36 (66.67%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.10.18.0 2008.10.21 -
AntiVir 7.9.0.5 2008.10.21 HIDDENEXT/Worm.Gen
Authentium 5.1.0.4 2008.10.21 W32/Trojan3.DK
Avast 4.8.1248.0 2008.10.21 -
AVG 8.0.0.161 2008.10.21 Worm/Generic.MYK
BitDefender 7.2 2008.10.21 Trojan.Dropper.Kobcka.FA
CAT-QuickHeal 9.50 2008.10.21 -
ClamAV 0.93.1 2008.10.21 Trojan.Agent-57176
DrWeb 4.44.0.09170 2008.10.21 Trojan.DownLoad.3735
eSafe 7.0.17.0 2008.10.19 Suspicious File
eTrust-Vet 31.6.6161 2008.10.21 -
Ewido 4.0 2008.10.21 -
F-Prot 4.4.4.56 2008.10.21 W32/Trojan3.DK
F-Secure 8.0.14332.0 2008.10.21 Worm.Win32.AutoRun.qzc
Fortinet 3.113.0.0 2008.10.21 -
GData 19 2008.10.21 Trojan.Dropper.Kobcka.FA
Ikarus T3.1.1.44.0 2008.10.21 Backdoor.Win32.Haxdoor
K7AntiVirus 7.10.501 2008.10.21 -
Kaspersky 7.0.0.125 2008.10.21 Worm.Win32.AutoRun.qzc
McAfee 5409 2008.10.21 Generic Malware.a!zip
Microsoft 1.4005 2008.10.21 Trojan:Win32/Emold.gen!C
NOD32 3542 2008.10.21 a variant of Win32/TrojanDownloader.FakeAlert.NA
Norman 5.80.02 2008.10.21 W32/AutoRun.GVT
Panda 9.0.0.4 2008.10.21 Suspicious file
PCTools 4.4.2.0 2008.10.21 -
Prevx1 V2 2008.10.21 Cloaked Malware
Rising 20.67.12.00 2008.10.21 -
SecureWeb-Gateway 6.7.6 2008.10.21 Virus.HIDDENEXT/Worm.Gen
Sophos 4.34.0 2008.10.21 Troj/Agent-HZB
Sunbelt 3.1.1741.1 2008.10.21 -
Symantec 10 2008.10.21 Trojan Horse
TheHacker 6.3.1.0.121 2008.10.21 W32/Generic!zip-dobleextension
TrendMicro 8.700.0.1004 2008.10.21 PAK_Generic.001
VBA32 3.12.8.8 2008.10.21 -
ViRobot 2008.10.21.1430 2008.10.21 -
VirusBuster 4.5.11.0 2008.10.21 Worm.Autorun.Gen!Pac.10
Additional information
File size: 32733 bytes
MD5…: 10e90f50b05d43f6c643421b4ad2b57e
SHA1…: 7edc1b3d0cc473051fa501650b616a6b7a4a05d1
SHA256: 6d68fd9e0a9666981baf13e8d0ad900b763c53b5a971da036906780c2101f0d2
SHA512: f7b05122eeb8eeabfbf0530b20785011964e47437d7c6d6b79551489a2cdf45b
fe94364b33951e15ed9e7473d953d2e5dd8418eef2d4257db311bda821ec4329
PEiD…: -
TrID…: File type identification
ZIP compressed archive (100.0%)
PEInfo: -
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=9F9D9FE300CD49B1A8ED004E46755000EE66BAF0

2

Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic and the virustotal results page might help and undetected malware in the subject.

3

Thanks for helping improving detection… hope they add this nasty soon…

4

I hope it gets added to the Virus Definitions soon too. I emailed the password protected zip containing the virus yesterday afternoon, however I am still receiving reports that the virus is getting through.