Slashdot Mirror
Anti-Virus Effectiveness Down from Last Year
juct sends us Heise Security's summary of an article detailing the abilities of 17 current anti-virus solutions. German computer magazine c't has found that, compared to last year, the virus scanners are having a more difficult time recognizing malware. Quoting Heise:
"For real protection, however, in view of the flood of new malware, the way these programs cope with new and completely unfamiliar attacks is more important. And that's where almost all of the products performed significantly worse than just a year ago. The typical recognition rates of their heuristics fell from approximately 40-50 per cent in the last test - at the beginning of 2007 - to a pitiful 20-30 per cent."
do they run on Linux?
FYI: I don't know what you guys are talking about half the time.
I've had a lot of people bring me infected PC's with smitFraud, that the big AV's have not even recognised or been able to properly remove, they have been pretty angry that the $90 or so they paid for a complete Internet Security product was not able to protect them.
It causes windows to pretty much choak and die as it just consumes so many resources and provides so much irritation, but major products like Trend or Symantec have not been able to successfully protect or remove them, I have had to use custom written tools that you get off the net for free. They really dropped the ball with that one.
I think the real problem with malware is that by the time an antivirus/antispyware program is needed IT IS TOO LATE. you have already been infected, antivirus software is for after the fact, cleaning up the files that were installed or warning you of their presence in a file atatchment etc.. The real defense here is preventing this from happening in the first place. That is, educating users not to click haphazerdly at anything that they feel like and that is a heck of a challenge. most users do not understand what can happen and many likely do not really care, they just want their new screensaver or whatever to work [bundled with spyware of course] and when their bad habits finally catch up with them when their computer slows to a virtual crawl, they go out and buy a new one thinking computers decay over time or something.
Sigs are too short to say anything truly profound so read the above post instead.
I always assume an antivirus is only as good as its current signatures. Heuristics are good but nowadays, I could literally count with my fingers the number of times it did the job. The best defense is still knowing what you are running with or without an antivirus. Most of the annoyances I see are done by the local script / virus kiddies, their work rarely make it outside the country so the signatures against those are not a priority. (Although what I hate is that most of this local scripts/virii are just copycats of popular ones, yet popular AV's rarely detects them...)
when you have an AV you have viruses, no AV no viruses
It's almost as if systems require genuine integrated security, rather than an anti-virus afterthought. Perish the thought.
No one company has the resources to be aware of every virus. The standard advice is to run more than one.
In Windows, if you wanna run more than one, you can only have the real time protection of a single anti-virus enabled or you get conflicts.
Meaning you rely on the on-demand protection of every other anti-virus and have to manually run them regularly OR set up schedules. What kind of user will do that?
Slashdot needs Geekcode | Can anyone recommend any good SCIFI? My tastes: Foundation, Startide Rising, CITY, Ringworld,
Just don't have AV's installed at all. Not having AV installed on my system keeps me from even thinking of trying anything stupid. every month or so I download a free trial of a Non Norton / Non Mcaffee AV program, update it and run a full scan. Then I do the same with a different one. Then I repeat with Spyware/malware programs. All that has ever been found is a few cookies. Safety through not doing stupid shit.
Why is it so hard to only have politicians for a few years, then have them go away?
An optimist would say that virus effectiveness has gone up.
The main reason for virus infections, as far as I can see, is because of people simply executing untrusted programs: downloading rubbish toolbars, screen savers and opening e-mail attachments which say "Pam Anderson Naked.exe". I think more "sophisticated" means of infection, such as buffer-overflows or browser bugs are relatively less prevalent than the simple act of directly executing a trojan program and infecting yourself (not that I have statistics to back me up).
Personally, I don't use an anti-virus product (at least, I don't have one running continously, bogging the system down). My protection mechanism is to simply not run programs I don't trust and also have the latest updates installed. In the rare event that I do need to run an untrusted executable, I run a manual scan on it.
After giving up the temptation to run these rubbish programs, I haven't been infected by a virus in years.
Are viruses really still a big deal? My impression for the last few years has been that even windows has gotten to the point where you basically have to grant a virus permission at some point along the line. I haven't used an anti virus in years and to my knowledge my windows installations are all clean (I do check them periodically with that Trend Micro online scanner dealie).
Still get RSI though.
That's 'cause you got arrogant and didn't properly firewall your hand before connecting it to the net.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
AG
I'm not surprised that F-secure did so well in behavioural blocking test, F-Secure Deepguard is amazing in recognizing malware application behavior even if it's not a know virus. Truly a nice advancement in virus prevention. Let's hope the competition gets as good as well.
The real problem is that its possible to just click on random stuff from mail, on the web and in IM clients and it gets installed. Because its such a big source of malware it shouldnt be done at all really. Many malware uses defects in browsers and OS and Antivirus is not a solution at all to those problems. Its not even bandaid then.
What i would like to see is Microsoft shipping a Windows version thats fairly secure out of the box. Then and only then Antivirus becomes something useful as a second added security layer. As it is now when it is the only security layer it doesnt work. Shipping Antivirus with Windows as Microsoft does is not a good solution but rather a recognition that they are not capable of delivering a fairly secure OS at all.
If users gets infected a lot by clicking the wrong things the sane thing would be to disable that function or atleast make it more safe. Like demand for example that a site that installs software is trusted by a third party.
HTTP/1.1 400
Why are we still talking about this in late 2007. What have the supreme innovators being doing the past decade. Ranum laid out the solution here:
"if I were to simply track the 30 pieces of Goodness on my machine, and allow nothing else to run, I would have simultaneously solved the following problems":
* Spyware
* Viruses
* Remote Control Trojans
* Exploits that involve executing pre-installed code that you don't use regularly
davecb5620@gmail.com
Use a Linux desktop distro, disable exec on the /home and /tmp directories, don't allow users to install software, case closed ..
..
Yes, I know what you're going to say, there aren't any Linux viruses because there aren't many Linux desktops out there. But where are all the server exploits out there being actively used in the wild. I'm talking about commercial servers being hacked not some msging board
davecb5620@gmail.com
I run Linux!
"The reason that Linux is largely unaffected is that it is not very widely used .. If/when we succeed in bringing Linux to the masses, this layer of protection will be torn away"
If that were true, where are all the Linux server exploits being actively being used it the wild. A Linux desktop logged in as standard user is safe from the numpties and is still usable. The dangers of screensavers wouldn't even apply here; even if a user managed to run some malware script it would most probably be confined to the users home dir, the core system would remain immune.
Re:yeah, but.. (Score:5, Interesting)
davecb5620@gmail.com
Bloatware, spyware, viruses, ....
For me they are all the same in the end they slow down your work.
I like Linux repositories, because those packages aren't controlled by sales department.
Each time I install a program on windows I have to run HiJackThis.exe to check it didn't put itself in the auto-run. The same is valid for 99% viruses, they use auto-run "features" to enable them to run each time you start your OS or application.
Love many, trust a few, do harm to none.
The funny thing is that AV software has been almost totally useless ever since we moved from floppy disks to Net connections - long before they started whitelisting malware from major corporations. As soon as it became possible to distribute malware more quickly than AV updates, AV software was dead in the water. And even before then, the writing was on the wall: the problem of detecting a virus is undecidable and you can't change the laws of math.
Good luck convincing your boss that AV software is snake-oil though. Best carry on paying and taking a performance hit every time you open a file.
>north
You're an immobile computer, remember?
... where you can whistle in 1200 baud and more over the phone ...
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
I disagree. I think the reason there are fewer pieces of malware floating around for Linux is because of the kind of roles Linux machines typically serve in. Most Linux machines are servers or enterprise workstations. In the case of a server, there will be a system administrator who is responsible for configuring the server, locking it down, and keeping it up. Chances are, they'll notice malware pretty quickly, and do something about it. Enterprise workstations aren't an attractive target, either: they're usually either a shared machine that's locked down hard, and under the eye of a sysadmin, or they're the pet of a tech-savvy user who wants his box in top condition so s/he can get stuff done.
/. geeks) looked at the files that this "codec" was installing, we would see that it couldn't be a real codec at all, and we could cancel the install; but an uninformed user won't know to look at file listings, and won't know what looks right, and what doesn't. It wasn't a failing of the OS: it was a valid installer package that prompted for authorisation to run; it was all about users who don't know how to administer a system.
Malware is all about money these days, whether it's herding bots so you can sell spamming services, or getting paid to DDoS someone's competitor, sniffing credit card numbers to buy stuff, or sniffing personal details for identity theft. Remember that your attack isn't 100% reliable, so you want as many potential targets as possible, and you want to attack weak targets so as to get the highest possible success rate. All so you can make as much money as possible, of course.
And what's the best target? Home Windows PCs, of course. No vigilant sysadmin monitoring the system; average Joe user doesn't grasp the concept of locking his box down, let alone have the m4d skillz to do it; Joe doesn't install patches regularly because he sees the downloads and restarts as nothing more than an annoyance; Joe doesn't really understand his computer, so he doesn't know how to look for the telltale signs of malware; Joe doesn't understand that he has to keep his virus scanner's definitions up to date, and turned off the annoying prompts; Joe doesn't understand a firewall, so he just clicks "Allow" to get rid of the warning message; the list goes on forever...
Now that MacOSX is becoming more popular, we're seeing a bit of malware for it, too. Example, that thing that claimed to be a video codec, but was really a DNS redirector. Now this one is a very good example of how malware authors target uninformed users: in the standard OSX installer program, there is an option to show the files that will be installed; if you or I (as
Until Linux is popular in the hands of inexperienced, non-tech-savvy home users (as opposed to enterprise), it won't be an attractive target for malware authors, and we won't see its security put to the test. When it does become popular, I expect we will see Linux malware, and I expect it will be like OSX malware, in that it relies on failings of the user, rather than the system itself.
For the record, I use OSX and Solaris at home, and develop for whatever I'm paid to develop for at work (which was, until recently, Windows, Linux, Solaris and OSX - looks like it will be just Solaris soon).
AVG for example shows nwn2main.exe (Neverwinter Nights 2 from Obsidian) as false positive.
Sure, it is partly because of the inane copy protection, but AVG should make some tests before issuing such a crap.
Luckily the 'infected exe' is recoverable, and after disabling the resident shield it will run. But then, why do you have AV in the first place?
Patents Drive Free Software as Hurricanes Drive Construction Industry
So what I need to do is uninstall my current anti virus and install one from last year, and not update it to the new less effective version from this year?
What if Tetris was invented by Nazis?
Antivirus has always been useless. It's not proper security.
Imagine having a door man that has a list of everyone you hate and everyone on that list is not allowed in your house. An enemy is prevented access but a stranger can still walk away with your TV. Wouldn't it be better to give the door man a list of all your friends instead.
Blacklisting is a really bad way to prevent unwanted activity. Whitelisting is much better.
...and that is all I have to say about that.
http://jessta.id.au
That's some pretty poor advice to run multiple anti-virus apps. other than AV vendors who all want a piece of the pie where is this being suggested? Initially there's the fact many conflict in their tasks and implementation to the point where having multiple AV software will sometimes goes as far as giving you a nice BSOD each time you boot up until you can mangle one AV app out of your system using recovery console or safe mode (Some versions of Symantec and McAfee for example). Ignoring that however there's the most prominent problem of the ridiculous drain in system resources you'll suffer from having one, let alone 2 AV apps - even worse if you stick an anti-spyware app. in also! I've yet to see any enterprise network deploying multiple AV solutions to the same machines and the only place I could see this being advised is the likes of Futureshop, PC World or whatever big chain wants to make as much money as possible selling useless apps in your particular country.
The best way to protect yourself from viruses or spyware is to not get them in the first place. That requires educating users to avoid sites that appear dodgy, to not download anything that isn't from a reputable publisher and to not open attachments unless you're expecting them and trust the source fully.
Current AV systems are flawed, malware has evolved but AV software really hasn't. It's still following the paradigm of reactive action which is hopeless in today's world because by the time AV software has acted the malware has already had chance to embed itself and potentially even disable or remove the AV in question.
It's only going to get worse also, I'm not entirely sure why we haven't seen extremely vicious viruses yet but I'd like to think that it's because anyone competent enough to writing such a virus would be intelligent enough to put their efforts elsewhere for good use. Looking forwards for example with advances in AI we might encounter viruses that can mutate to use new security holes, viruses that work as P2P networks to distribute virus updates and hence become as difficult to shut down as the file sharing phenomenon and so on. The current AV market is both a sham and a scam, to suggest that much of the AV software out there really protects people is a lie, it doesn't. The times I've seen AV programs out there detect stuff it all too often can't clean it and so manual removal ends up being the only solution anyway.
Viruses need to be stopped at the borders, but the difficulty is simply the amount and type of borders (Internet - various services, floppy, USB, CD, etc.). We can of course follow the trusted computing route but that's not ideal either because companies don't trust us to use our computers so we lose a massive amount of freedom which to many of us makes computing great. There's no easy solution to the problem but the current option offered by AV vendors isn't even a viable start to the solution now, let alone in the future, it's like trying to save a decapitated person by sticking bandage on their neck when the only way to save them was to prevent such an accident in the first place. Sticking multiple bandages on that neck still isn't going to save that person!
really just make my machine choke and die. I run an ancient computer with only 256 RAM, more than enough for my use, but not long ago I knew I'd been infected. So I HAD to install something.
I ended up installing the free 30 day trial from Norman. Long story short, it's the only AV I've ever tried that I didn't positivly hate.
The real reason for massive viruses is windows. I know all of the "unbiased" people will mod this down, but you are fooling yourselves think windows is a legitimate operating system. I set my brother and uncle up with ubuntu boxes last summer and they haven't needed to reboot yet! No viruses. Top speed. Both of them previously had windows machines that took all of about 2 weeks to get so loaded with viruses, it was silly. They haven't had a problem with this since May. Windows isn't going away, you say, but it friggin' should. You probably want to call me a "fan boy", but you have chosen and/or support the wrong operating system, plain and simple. Every time I set someone up with a Linux box, their virus problems go away and their machines (ancient) purr. Am I biased? Confused? Its friggin' results people. I tell you what, if you've done the work to convert four *real* people away from that shit operating system windows and still disagree, mod this down. If you haven't then you have no business having an opinion. I speak from the trenches--real users with *no* savvy, personal computers, home use, no VM. I set them up and they fly. Convert some of these people and see how they begin loving their PCs. Don't mod this if you don't have the cred. Mod it up if you know what I'm saying.
Just callin' it like I see it.
I've known that AV software doesn't work very well for quite a while. Its really nothing new. It is nice to have someone doing tests that I can shove in peoples faces, though.
This isn't the biggest problem though. AV software is actively harmful. Aside from dramatically slowing down EVERYTHING, it can flat out break stuff. Norton in particular is notorious for screwing things up, to the point that if someone asks me about a problem with their computer now, my first answer is always "uninstall Norton."
Running the gambit from games being intolerably slow to programs crashing to drivers inexplicably failing to install (even after turning Norton off), to date "uninstall Norton" has never failed to fix the problem.
(Really, Norton and the virus makers themselves aren't much different, in that both of them prey on the computer illiterate.)
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
And it will fall still further.
Time was a virus would either just pop up an annoying message or delete random data or reformat your PC. Effectively viruses and virus writers were hunters and once they had got the target they had no further interest.
Virus writers have now become 'civilised' farmers. They now get paid for their efforts.
The writers have a tame herd (of infected PCs). They will spend their time trying to make sure the AV software will not interfere (to them these things are the infection). They spend their time tending their herd and catching 'wild' examples - other peoples virii (?) so they cross-breed.
One consquence of this (if correct) is that viruses may well start to remove other infections, and generally tune up your PC. After all, if your PC is working just fine, why would you bother keeping the AV scanner up to date?
I tried that too, and it was the only time I ever got infected by accepting some random packets. No thanks, I'll stay with what I know.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
man cron; man at
Never install anything executable ,where you do not trusts the author.
No single virus for all these years.
and if you do really need something try
http://www.virustotal.com/en/indexx.html
You can't hope to really fix bad behavior with technology. This is why instead of giving dad a false sense of security with cpu/disk thrashing AV software, I took the time to show him the nastiness that can go on, especially with email attachments, and downloading and running software he doesn't know anything about. I also set him up with firefox with the adblock plus extension. On his own (even though I didn't feel it was necessary), he manually runs adware detecting software to make sure nothing has been slipping by. Three years, and he has yet to be infected with anything (manual AV scan with latest signatures when I was there the other day confirms).
Tools and their uses:
- Firewalls: block stuff you shouldn't be listening for anyway, also help to mitigate against attacks against stuff you do listen for.
- Service Lockdown (difficult on windoze, see "Firewalls" above): You can't exploit something that's not there
- Proper configuration of what you do need listening: default stuff on that linksys router, for example
- Patches: Deal with worms (not viruses)
- AV software: tries to correct user stupidity. Not exactly a winning battle, as can be seen by the existence of this article.
- IDS: Never for an end user. How are they to know how to tune it, and what the messages mean, etc?
My experience has been that AV software gets in the way, causes system instability, and provides a false sense of security. None of this provides a significant benefit for a user who already practices good hygiene on their computer.
It was prone to happen. Actually I'm amazed it's considered news.
...
The malware-antimalware war ain't a static one. Both sides are engaging in a quite impressive arms race. They start creating morphing trojans, we create ways to detect them, they create global trojan floods, we employ detection networks to catch them, they switch from mail distribution to infected webpages, we start sending out spiders, they start using targeted spam, we create fake personalities to be "interesting" for them, they
It's just the same with the detection and elimination routines. They use certain API calls, we start listening to those calls carefully, they switch the calls, we follow, they start using executable packers, we develop exec unpackers, we discover that malware PE headers have a certain format, they change the format and create "filler" sections to look normal...
It's just a chapter in that arms race. Give us 2 months and we're back on par.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
"Alles turisten und nonteknischen lookenpeepers! Das komputermaschine ist nicht für der gefingerpoken und mittengraben! Oderwise ist easy to schnappen der springenwerk, blowenfusen und poppencorken mit spitzensparksen. Ist nicht für gewerken bei dummkopfen. Der rubbernecken sightseeren keepen das cottonpicken händer in das pockets muss. Zo relaxen und watschen der blinkenlichten. "
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
I don't think that it's the effectiveness of the heuristics that has decreased. It's probably the virus and malware programmers have gotten craftier: studying how these algorithms work and countering them. It's one of the reasons why I stay away from the mainstream AVs.
One word: FUD!
The biggest problem to the windows desktop today is that most applications aren't updated... Most people doesn't update Java, Quicktime, Acrobat, Mediaplayer, flash or even their browser. And doing this is rather difficult, by now many more of them have automatic updaters, but most people ignore those, or switch them off because they are annoying.
Applications like these are the once making windows very insecure, ofcourse the windows update that doesn't work very well contributes a lot too... But lack of systemwide update manager or packagemanager if you like is why millions of PC's need virus protection.
On Linux apps are usually patched very fast and all apps are updated through the packagemanager. If the update manager didn't popup every second day or so, I'd never update my apps... Especially not if I had to download a separated installer/updater, like most windows apps still requires...
On my parent windows machine, which I borrow from time to time for printing, I used Opera.. I think it's version 8.x and every time I start it it popups saying there's an updated version. But I just want to go online to download a document for printing, or who knows and close it instead of actually bordering to update opera
Why not make it clear: copy protection mechanisms is malware... It does not serve you! And Sonys rootkit were installed with your consent, in the sense that you clicked ok to something a lawyer wrote, but no one else have read...
Instead of wasting effort on the unwinnable war of detecting mallicious intent in executable software -- Perhaps people should concentrate on preventing said execution in the first place.
Apparently they are unaware that the diversity which sexual reproduction creates effectively limits the size of the population which a virus can infect, severely curtailing the spread.
Deleted
Since this article is about a print article in German, you may want to check out the site http://www.av-comparatives.org/
.Net 2.0.
Malware is an arms race, and the comments about AV software being useless are bull. It just isn't a panacea either. Schneier says security is a trade-off. Average users don't want to be inconvenienced by things like applying the principle of least privilege. Personally I use SudoWn and Runasspc with my XP Pro system when I need to elevate something to admin, and a combination of Avira/Spybot-SD and Firefox with NoScript. That's the software side. The most important thing I do for my security is to mistrust everything by default. I don't install stuff that's likely to be infected. Even if I think something is safe, I scan it manually before I run it with admin privs. I've been virus/malware free since I put this system together back in March of this year, and I've probably installed nearly 100 applications in that time.
PS: The later versions don't seem to work for me, but version 2.0 of SudoWn does, and it requires
Hopefully this is helpful to at least one person.
Default Allow is fundamentally not a basis from which a system can be secured. It forces every system user to maintain perfect knowledge of a changing universe. Default Allow plus virus detection is, in the limit, equally doomed. Fred Cohen pointed out over two decades ago that virus detection is equivalent to solving the Halting Problem. Either way, it signs us up for an infinite amount of work.
Default Deny, on the other hand, certainly requires us to do some work, to consciously qualify those 30 pieces of Goodness. That requires explicit effort, but it's a finite amount of work. So why, in the face of such clear advantages, do so many people want to avoid this policy? I can only think that they resist the idea of responsibility. And that's a matter of perception, something that I hope people will eventually come to rethink.
Parity: What to do when the weekend comes.
I have been removing viruses from friends and clients computers since I was 8 years old (I'm almost 24). 99% of these have been on microsoft OSes or Dos-esque OSes. I have never failed to clean a system until yesterday.
Using a combination of virus removal tools and a process viewer and a few other security tools on a CD-R i've been able to find every instance every time - until yesterday. In a few cases i've had to replace some system filed due to them getting completely destroyed or had to repair an MBR, but never before did I have to say "time to do a low level format and start over"....
I had installed cleaned this guy's system about 2 years ago. He was setup with a non-admin account to use and automatically renewing virus scanning, ad-aware, and several other security tools.
Yet after his niece used the PC it became infected.
I could see this virus running, I even found 1 virus with F-PROT - AVG, Kapersky, Avast, and BitDefender all found nothing. I had to run them from a boot CD because the virus had done something funky with administrator rights even under safe mode.
I felt horrible, because truth be told, if I back up his documents, I can't honestly tell him reloading them on a clean system won't b ring back the virus - the detectors couldn't find them before, they may not again.
All I could say was I'll make a ghost disc so you can get the system back to normal by yourself. I haven't dealt with Vista viruses yet, but there is no stopping a novice p2p user from getting a virus.
Get a web developer
[quote][b]"I could see this virus running, I even found 1 virus with F-PROT"[/b] - by datapharmer (1099455) on Friday December 21, @04:20PM (#21784590) Homepage[/quote]
.exe OR .dll/lib based ones).
IF you can get its name, & location on disk? Boot to RECOVERY CONSOLE, & fry it then (nothing will be loading & thus, locking it, there).
It's THAT, or using Process Explorer, suspending the calling process, via watching loaded DLL's (CTRL+D with the lower pane view set like that) IF there is one and this thing doesn't launch by itself from one of the registry RUN areas or startup groups that is...
Using Process Explorer can help, especially if this is being run by "DLL Injection" (like an OLEServer being injected into a process via CLSIDs, shell extensions, or being run by rundll32.exe OR svchost.exe, process hosting executables that can spawn either
The easier/simpler route? Use Recovery Console, once you have its name & location on disk... DEL command will take care of it, lickety-split, no-shit.
APK
"I could see this virus running, I even found 1 virus with F-PROT" - by datapharmer (1099455) on Friday December 21, @04:20PM (#21784590) Homepage IF you can get its name, & location on disk? Boot to RECOVERY CONSOLE, switch to the folder that houses it using CD (almost like DOS one, but uses .. ONLY, to switch to ancestor folder roots really (instead of \ etc. et al))!
.exe type)
.exe OR .dll/lib based ones)).
Then, once you are in its folder, fry it then (nothing will be loading & thus, locking it, there) using the DEL command -> DEL filename.
----
It's THAT, or using Process Explorer in UserMode/Ring 3/RPL3 operation...
You would do a suspending the calling process via right click popup menu options for this it offers!
(This ia assuming this is a lib loaded virus/spyware/trojan/malware etc., not a standalone
That's done via watching loaded DLL's that ANY app may have loaded presently (For that, you would have to use ProExp's CTRL+D keystroke shortcut, with the lower pane view present/visible, & set like that) IF there is one and this thing doesn't launch by itself from one of the registry RUN areas or startup groups that is...
Using Process Explorer can help!
(Again, especially if this is being run by "DLL Injection" (like an OLEServer being injected into a process via CLSIDs, shell extensions, or being run by rundll32.exe OR svchost.exe, process hosting executables that can spawn either
----
The easier/simpler route?
My first suggestion:
Use Recovery Console, once you have its name & location on disk... DEL command will take care of it, lickety-split, no-shit.
APK