It could be W32.Yaha.K@mm
http://securityresponse.symantec.com/avcenter/venc/data/w32.yah...@mm.html
If that dosn't work try this. On a clean PC Download the following Programs.
Download Sophos and the latest IDE Files. Install it and extract the IDE files to the SAV32CLI folder. I normally create batch Files for the 4 runs.
EG: Sav1.bat
cd\SAV32CLI
SAV32CLI -P=C:\SCANLOG.TXT
http://www.sophos.com/support/knowledgebase/article/13251.html
Running an information scan
To run a scan for information only, so as to create a log, type the following at the command prompt:
SAV32CLI -P=C:\SCANLOG.TXT
This will create a log of infected files, but will not disinfect or delete any infected files. You can then copy the log to a floppy disk for printing or emailing. If you run SAV32CLI without the -P command line parameter, the information on viruses will be written only to the screen.
Disinfecting infected files
To disinfect infected items with SAV32CLI, use the '-di' command line parameter.
If a file is infected more than once (either with different viruses, or several cases of the same virus), you might need to run multiple scans to disinfect all virus infections.
Do not use the command line parameter '-remove' in the same scan as '-di', as you could delete a file which could have been cleaned.
If the infection on the computer seems to be progressing rapidly, back up your data to CD or DVD before attempting disinfection.
The '-di' command line parameter will disinfect infected boot sectors, some infected program (.exe) files, and infected documents (e.g. .doc, .xls).
So, if your computer has been infected by a number of viruses, macro viruses, and worms, shut down the infected processes (either manually, or by using safe mode with command prompt), then run a series of scans to disinfect and remove these malicious programs. Make a log of all scans.
First run
SAV32CLI -DI -P=C:\SCANLOG1.TXT
Make a note of the number of files disinfected.
Run the scan again, with a different log name
SAV32CLI -DI -P=C:\SCANLOG2.TXT
If the number of files disinfected has decreased, run a third scan. If it has not, or the number is '0', remove all other virus files:
SAV32CLI -REMOVE -P=C:\REMOVLOG.TXT
The above scans will disinfect all files that can be disinfected, and remove the rest.
During this process any infected documents will have been disinfected. Check the relevant virus analysis to find out if the virus involved could have corrupted data in the document. If you check the logs, you may well find that some worm or Trojan files were infected with a virus, so they were first disinfected, then removed.
Download Spybot - Search & Destroy 1.5.2 and install it. Update it.
http://www.safer-networking.org/en/download/index.html
Run Spybot to check if any remnants have been left.
Copy all installed Folders to a Flash Disk including HiJackThis and any batch files that I recommend creating.
Start the Suspect PC in Safe Mode and run the Programs in the order that they were downloaded with the instructions provided.
By now if still infected you should know the name of the Virus.
