What signature works for blocking/shunning emails with this Trojan in it?

I have IDS 4215 and PIX 515 with failover running 6.3 image. I believe I have the IDS configured for shunning via an ssh connection to the PIX (show ssh session show connection). Latest signatures (203) are installed on the IDS – IDS see a threat (3...