Security researchers have crafted a new exploit that can bypass protections of dozens of the most popular anti-virus tools. In layman's terms, the method works by sending the anti-virus software a sample of code that will pass the security checks and then, before the code is executed, swap it with a malicious payload. All anti-virus programs that use SSDT (System Service Descriptor Table) are affected, which includes all of the 34 products the researchers tested, including software from McAfee, Trend Micro, AVG and BitDefender.
The exploit has to be timed just right so the benign code isn't switched too soon or too late. But for systems running on multicore processors, matousec's "argument-switch" attack is fairly reliable because one thread is often unable to keep track of other simultaneously running threads. As a result, the vast majority of malware protection offered for Windows PCs can be tricked into allowing malicious code that under normal conditions would be blocked.
All that's required is that the AV software use SSDT, or System Service Descriptor Table, hooks to modify parts of the OS kernel.