Good to see, that you are still alive

Here the relevant rules for the Agent:
Agents are autonomous programs that are rated from 1 to 6. Each agent occupies one program slot on your deck.
Agents use the Matrix attributes of the device they run on, and their rating (up to 6) for attributes. Agents also have the Computer, Hacking, and Cybercombat skills at a rating equal to their own. An agent runs as a program and can use programs running on the same device as them. You can have your agent perform Matrix actions for you. When an agent is running, it has its own persona (and icon). An agent is about as smart as a pilot program of the same rating (Pilot Programs, p. 269).
Any attack on an agent damages the device on which it is running, rather than the agent itself (which is, after all, merely a program). This means that if you’re running an agent on your deck, you and it share the same Matrix Condition Monitor.
There are no definitive rules regarding Hosts running programs, but I'd rule they have the capacity to run almost everything - even if they have to emulate a deck. That's how I rule this.
This virtual deck has a device rating of 7 and a matrix monitor of 12. In essence the Kerberos agent is like a spider without the biological vulnerability.
So no, the Agent does use the firewall attribute of the host it runs on (Just a emulated one). The Agent can use Full Defense.
The easiest thing to do now, would be to spend one point of edge, reroll or add some dice and shut the Agent down.
At the moment you have one legitimate mark on the host (by entering through the still open connection of the dwarf) and two illegal marks on the agent and therefore the virtual deck it's running on.
You can dataspike the virtual deck, but that would only mean the virtual deck is reloaded shortly afterwards. You could of course overwrite the boot sector first, preventing the virtual deck from loading again.
Regarding the file: It's self replicating and modifying (meaning, it reads, copies and edits each other permanently). If you delete one, it will be replaced shortly afterwards. You can edit or encrypt each file to stop this replication mechanism, but that would mean thousands of edits.
An elegant solution would be to modify one file in such a way, that it will destroy itself and all others by itself.
That would be an extended Software+Logic[mental] test with (18, 1 Combat Turn)