My Norton Antivirus has detected the virus "PWSteal.Trojan" in the file "C:\windows\system32\mnsvcsp.exe". NAV could not delete the file. What shall I do to get rid of this virus and replace the infected file?

Is it in quarantine? You can rename it and then delete it, or try deleting it in the safe mode, since it is probably listed as in use. Take care!

Um, ok, did you try to delete the file yourself? If so, did you get an error that said "Unable to delete file; access denied."
or "unable to delete, source file may be in use"...if you did, it's probably because the source file is in use...try clicking start, then run, and type in regedit...when regedit opens, at the top click edit, then find, and type in mnsvcsp and see if it comes up...and if so, delete it from the registry, but BE CAREFUL!! MAKE SURE YOU DONT DELETE ANYTHING IF YOUR NOT SURE WHAT IT IS!!! (also, if you are maybe new to norton...open norton, click reports, then quarentine...and make sure the file is in there...) Imma shush now, i hope i helped

NAV 2002 just found PWSTeal.Trojan in mnsvcsp.exe

Can't repair it but it's in quarantine.

Waht should I do now?

Thanks in advance

hey I had the same virus today, 18 dec 2002, I deleted the file by ending the proces in the taskmanager. I went to the quarantain area in NAV2003 and then deleted the file. I also search in the register for the file.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

here is the file, you must backup the registry item you want to delete.

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/199762382617

after you did that, you can delete the register item

GOOD LUCK!!!!

A few days ago I had the same virus... I killed the proces in taskmanager and was able to delete the mnsvcsp.exe file. But now, a few days later, Norton says I have the same virus.. Only now, it's got an .dll extension. So the virus is mnsvcsp.dll . I can't delete the proces in taskmanager, caus it's not a program, but a dll. When I try to manually remove it, it says: acces denied, file may be in use..

What should I do? PLease help me. I can't place the file in quarantaine, can't delete, rename etc...

I had the same problem, and I use the same way to delete the exe and the dll which were infected. I just boot with the CD of Windows and use the repair mode to delete the file. It's the most simply solution if you have Windows Xp or Windows 2000, else, if you have an other windows, you must boot on a bootable floppy disk to delete the file.
I hope it will help you and I'm sorry for my English but I'm Belgian and I speak French.

The file is still unremovable in safe mode. What should I do? Is safe mode the same as repair mode?

Yesterday I had all the same symptoms as most cases above: Norton AV refused to delete or quarantine the MNSVCSP.DLL from D:\WINDOWS\SYSTEM32.

When I rebooted, MNSVCSP.EXE had started running in Windows Task Manager. I was able to delete this .EXE from there, but not MNSVCSP.DLL.

MNSVCSP.DLL was last modified in the end of November, just after I had opened some FIFA 2003 Serialcode s--- got from Kazaa. From the registry times I presume it had come with that s---.
Around that time I had some virus with the name at least very close to MNSVCSP.DLL. That was quarantined etc. successfully with Norton AV.

But suppose not permanently, as this came out!

Now in the registry there were names of all the files (msdos98.exe, uninstallms.exe, mine.exe..) supposed to be associated with this virus and listed in the Symantec PWAteal.Trojan -help page:

http://securityresponse.symantec.com/avcenter/venc/data/pwsteal.trojan.html

Well the problem was unsolved until this morning, when suddenly, after about 1000th notification from Norton AV told that virus MNSVCSP.DLL was found and deleted!

How come Norton succeeded to work now, I dont have a clue. Anyhow D:\WINDOWS\SYSTEM32 seems to be clean.

Well, unfortunately for you this msg was not a problem solver . Hope info is for some help anyway.

I had the same PWsteal trojan virus on my computer running windoze XP professional. I was able to get rid of the mnsvcsp.exe after shutting down the progress by using the Task manager. Two days later the mnsvcsp.dll was infected and NAV was unable to delete it. I couldn't delete it manually, even in safe mode I had no permission. I tried many things and finally found a solution:
search your registry for "mnsvcsp" -> delete all the search results (after saving a backup of your registry), even the whole folders found -> reboot system -> let NAV scan the mnsvcsp.dll -> it will automatically delete it! If you have downloaded some FIFA2003 serialz from kazaa (that infect you with the virus), delete those files first.

Don't bother anymore. I was able to delete the mnsvcsp.dll in the winxp recovery console. Here's what you should do: Put the win xp cd in the drive and reboot. Prss a key to boot from the cd. Then wait for quite a long time, and when the welcome to setup message appears, you type R. Then you get a dos-like screen. Type DEL and then the path for the file you wish to delete. Her eit was: Del c:\windows\system32\mnsvcsp.dll and the problem is solved! I couldn't find any other way to get rid of the file than this one... Good luck to you all!

I had the same virus 2 weeks ago. Everything was OK after I deleted the mnsvcsp.exe file following Symantec's instructions. Now since a few days this mnsvcsp.dll infection keeps popping up in my NAV. It says that the corrupt file is in Windows/System32 but I can't find it there. Even with the search option in explorer or in dos-prompt mode I can't find it (I've set my map options to show all files). How can I get rid of this file ? Is it still harmful even if the exe-file has been removed ?