I know this doesn't help with your immediate problem, but I am going to put in a plug for Sophos. It is a superior product with a great management console and excellent tech support. 

I have had several instances when teachers have complained to me asking why I am blocking legitimate sites. When I checked their complaint, I found that it wasn't the web blocker that was preventing them from reaching the site, but Sophos. Sophos will, at least in some cases, detect an infected web site and block the page from even loading.

I am not sure how it handles the particular virus that you are dealing with, but it might be possible to get a trial install to check it out.

Doug Reaves

CONFIDENTIALITY NOTICE: The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you received this communication in error and then delete it. Thank you.  

>>> "Craig Lyndes @" <[log in to unmask]> 2/10/2010 1:59 PM >>>

We're on our fourth Internet Security 2010 virus today!!!  This has become
our biggest service issue.

One question - does anyone have an antivirus program that prevents a
computer from becoming infected once a compromised web site is visited????

I can say unequivocally that Microsoft Security Essentials and AVG DO NOT

The human engineering with this virus is excellent.  Once the person
becomes convinced that they should install the program that pretends to be
antivirus (but is actually a virus) then nothing, the antivirus we
install, or Windows, stops them.

I read an article yesterday that said there is a keystroke logger is part
of some of these variations, and that has lead to $370,000 being
transferred from the accounts of the town of Poughkepsie NY to somewhere
in the Ukraine.  I have alerted the business office.

One of the people today said it first struck from Yahoo....  This is
really bad news.  Maybe an ad not they Yahoo web server, but it isn't from
muck raking.

Thank god for imaging.

Craig Lyndes