Uroburos Malware Defeats Microsoft's PatchGuard

Introduced years ago for 64-bit editions of Windows XP and Windows Server 2003, Microsoft's Kernel Patch Protection, or PatchGuard, is designed to prevent malware attacks that work by modifying essential parts of the Windows kernel. If a rootkit or other malicious program manages to tweak the kernel, PatchGuard deliberately crashes the system. This same feature made life tough for antivirus vendors, as many of them relied on benignly patching the kernel to improve security; they've since adapted. However, a new report from G Data states that a threat called Uroburos can bypass PatchGuard.

Hooking Windows
Rootkits hide their activities by hooking various Windows internal functions. When a program calls on Windows to report the files present in a folder, or the values stored in a Registry key, the request goes first to the rootkit. It in turn calls the actual Windows function, but strips out all references to its own components before passing along the information.

G Data's latest blog post explains how Uroburos gets around PatchGuard. A function with the bulky name KeBugCheckEx deliberately crashes Windows if it detects this kind of kernel hooking activity (or several other suspect activities). So, naturally, Uroburos hooks KeBugCheckEx to hide its other activities.
 
Full Article