Different Way To Tamper Windows Kernel

"Security researchers have discovered one of the most subtle and sophisticated examples of Windows rootkit software known to date," writes The Register.

Worm.Win32.AutoRun.nox, as F-Secure calls it, extends the standard virus writer trick of using software vulnerabilities to infect systems, by including functionality that allows the worm to exploit Windows security bugs to hook into parts of the Windows system that operate below the radar of anti-virus packages.

"Most malware with rootkit functionality will tamper with the Windows kernel and attempt to execute code in kernel mode. Typically, a special driver is used to do this, " writes F-Secure. "AutoRun.nox is different — it uses "GDI Local Elevation of Privilege Vulnerability (CVE-2006-5758)" to do the job. For malware, its rather unique to see such a technique being used." Microsoft patched the vulnerability in April 2007 update (MS07-017).

More detailed description of AutoRun.GM can be read from F-Secure Blog.