May be a new variant. Do you have a sample that you can submit to Security Response?

http://www.symantec.com/business/security_response...

New signatures can then be created in an upcoming definition release.

There is no tool specifically for this threat. Try the Power Eraser utility, it is included in the SEP support tool.

http://www.symantec.com/business/support/index?pag...

Make sure the SEP definitions are latest. Try increasing the sensitivity of the Truscan Proactive threat protection.

Also, run SEP support  tool-loadpoint on the infected computer, and  try  to upload the  logs here...

Hi,

It is recommended to install all the Symantec features AV / PTP/ NTP with latest definitions.Always make sure that your computers are receiving definitions regularly.

You can upgrade your product to latest built i.e RU6 MP3

You windows machines should have all the latest windows updates /Patches.

Apply application and device control policies, block USB etc.

Disable Autorun.

Please follow best practice guide to handle virus issue.

http://www.symantec.com/business/support/index?pag...

Hello,

You need to work on this immediately. Please check the Article and Submit the Suspicious files to the Symantec Security Response.

Using Symantec Support Tool, how do we Collect the Suspicious Files and Submit the same to Symantec Security Response Team.

https://www-secure.symantec.com/connect/articles/using-symantec-support-tool-how-do-we-collect-suspicious-files-and-submit-same-symantec-sec

As a side task, users should be educated on the dangers of FakeAV and what to look for and not do.

As Brian stated, education of the threat landscape is a must.

See the Security Best Practices - https://www-secure.symantec.com/connect/forums/whe...

This is maybe 1000th times we see this, making long story short this threat is an advanced fast updating threat distributed using different attack vectors. Symantec is not good at detecting it first hand but with help of limited user access + updated flash + updated java (if existed on client) + update adobe reader and utilizing SEP hardening application & device control policy you may reach a pretty safe ground.