Virus file won't delete!

[project dragon]

ok here is thr problem.
I think I did the stupidest thing the other day and decided to click on a link on msn that asked me if I wanted to download a file. It said that is runs on MS-DOS, and.. well.. i accepted it =\
so now i have some trojan virus on my computer. I believe that I have found the folder (C:\WINDOWS\system32\mcitwsms) after looking for quite a while cause it was hidden. The virus turns off my firewall and my system restore everytime I log on to my computer. I believe the file is called CSRSS.EXE, because when I open my task manager, there are two of these files, one that is operated by the system and one that seems to be opperated by me. I found both files and I am sure the one in the file above is the virus. I cant delete the file though because the program is still running, but i cant end the program off task manager because it says its a critical system process (cause you need the actual csrss.exe file for windows operation).
Is there any way for me to delete this file or folder? I dont know how to do it in command prompt, but I think that is where I am suppost to go to delete the folder
Thank you for your time =)

[StarKitty]

Download Webroot Spysweeper... the 30 day trial.

Update it then run a full scan, it will find the files and delete them. Any files it can't delete it will ask if you want them deleting on next boot up (before they start running)

Also Spysweeper will find any changed system settings that are abnormal and ask if you want them resetting.

I'd suggest investing in actually buying spysweeper.. i've found it to be the most reliable viral killer on the net..

If that doesn't work, or if the virus re-installs itself then try running multiple scans on multiple sweepers, then re-starting, then running more scans. Eventually you'll get it entirely.

Others to try include
Ad-aware SE
Spy Subtract
CWShredder

(CWShredder comes with spysubtract)

[iKillburger]

theres a freeware program called hijack this that can delete any file upon startup. more than likely there are other files or registries that will restore the file tho. what i did once was hijack this deleted the file during startup, i created my own file with the same name and placed in that folder and made it read-only

[Krusnik]

Well scan your computer with, http://housecall60.trendmicro.com/en/start_corp.asp Do the full virus scan, and see if that works if that doesn't work try Microsofts Antispyware Beta. Do a deep scan. I did some research, and if it's that stupid "wow is this you" thing do this http://securityresponse.symantec.com...32.chod.d.html, if that doesn't work try this http://www.ihud.com/file.php?file=11..._msn_virus.zip download it, and read the text. If you had norton antivirus, and it got corrupted do this ftp://ftp.symantec.com/public/englis...gen/SymNRT.exe
it'll fix the corruption thing. Hope it works. Good luck!

[project dragon]

majin please have my babies =)

that was the exact virus that I had. I couldnt access any antivirus sites, or install norton at all, but they seem to work fine now =)


Thank you very much!!! =D

[Badshot]

AVG free version does the trick for any virus problem almost.

[BleakFuture]

Gotta love happy endings.......

[Tone]

write a .bat that deletes it and have it run on start.. or a feature in hijackthis has delete file on reboot., or you shoyuld be having a virus scanner that has boot time scan like avast, which scans in a blue screen before any bit of windows is loaded ..

[Krusnik]

write a .bat that deletes it and have it run on start.. or a feature in hijackthis has delete file on reboot., or you shoyuld be having a virus scanner that has boot time scan like avast, which scans in a blue screen before any bit of windows is loaded ..

I fixed the problem don't come here with all of your complicated bullshizzle.

[Badshot]

I fixed the problem don't come here with all of your complicated bullshizzle.

I dont see anything complicated