This "virus" has not yet been released into the wild and it appears it is based on a very old general vulnerability.
The difference is that this new exploit uses the a multiprocessor scheduler to switch good software with malware between running threads. IIUC, virus programs do not check for these kinds of swaps in pagable memory before allowing code to execute. The kernal does, but then it does it to regulate which memory space gets written to and it does not distinguish between the two types of software.
| So what are we end-users to do about it? |
Researchers say they've devised a way to bypass protections built in to dozens of the most popular desktop anti-virus products, including those offered by McAfee, Trend Micro, AVG, and BitDefender.
The method, developed by software security researchers at matousec.com, works by exploiting the driver hooks the anti-virus programs bury deep inside the Windows operating system. In essence, it works by sending them a sample of benign code that passes their security checks and then, before it's executed, swaps it out with a malicious payload. |