New Vulnerability Uses Antivirus Software to Inject Malware

AVGator is a vulnerability in multiple antivirus products where the "restore from quarantine" feature can be exploited to move quarantined malware into privileged directories (e.g., C:\Program Files or C:\Windows) using NTFS junction points and DLL search-order abuse, allowing the malware to run with full privileges; a researcher demonstrated this via a phishing infection during a penetration test. Vendors including Emsisoft, Ikarus, Kaspersky, Malwarebytes, Trend Micro, and ZoneAlarm were notified and have released updates; the technique requires physical/local access, making shared-computer environments most at risk. Analysts recommend keeping antivirus software updated and disabling restore-from-quarantine functionality.