My first question is do you have IPS enabled and up to date? There is an IPS signature available that will block the download, which stops it from getting onto the disk in the first place.
You should also have Download Insight and SONAR enabled to block this threat. Are these components utilized as well?
You may want to review your SEP security settings:
Security Response recommendations for Symantec Endpoint Protection 12.1 settings
http://www.symantec.com/docs/TECH173752
Eliminating viruses and security risks
http://www.symantec.com/docs/HOWTO27280
Symantec Endpoint Protection – Best Practices
http://www.symantec.com/page.jsp?id=stopping_malware
Best Practices for Troubleshooting Viruses on a Network
http://www.symantec.com/docs/TECH122466