How to remove ph.exe

CRC32: F19784D8
MD5: 82078EEF0FD658BDF296D1D644EFEF71
SHA-1: 5A35FD3FFFC0FA3EE3873E46A30A3F6ED289C81E
 ===================================================
One or more files with the name PH.EXE creates, deletes, copies or moves the following files and folders:

• Creates c:\docume~1\user\locals~1\temp\xma6.tmp
• Deletes c:\docume~1\user\locals~1\temp\herss.exe
• Deletes c:\docume~1\user\locals~1\temp\cvasds0.dll
• Creates c:\docume~1\user\locals~1\temp\cvasds0.dll
• Deletes c:\ph.ex
• Copies filec:\docume~1\user\locals~1\temp\herss.exe to c:\ph.ex
• Deletes c:\autorun.in
• Creates c:\autorun.in
• Deletes d:\ph.ex
• Copies filec:\docume~1\user\locals~1\temp\herss.exe to d:\ph.ex
• Deletes d:\autorun.in
• Creates d:\autorun.in
• Deletes c:\docume~1\user\locals~1\temp\am1.rar
• Deletes c:\docume~1\user\locals~1\temp\am.ex
• Opens/modifes c:\autoexec.bat
• Creates c:\docume~1\user\locals~1\temp\am1.rar
• Deletes c:\docume~1\user\locals~1\temp\am.exe
• Creates c:\docume~1\user\locals~1\temp\am.exe
• Copies filec:\docume~1\user\locals~1\temp\am.exe to c:\docume~1\user\locals~1\temp\herss.exe
• Deletes c:\docume~1\user\locals~1\temp\cvasds1.dll
• Creates c:\docume~1\user\locals~1\temp\cvasds1.dll