The bottom line is that antivirus and antimalware programs only detect
*some* of what they try to detect. The best approach is to limit the
amount of malware that you expose those programs to. Adhering to best
practices may result in avoiding 95% (just a guess) of malware out
there. The rest will be worms (i.e. exploit based autoworms) and
viruses
(downloaded from *reputable* sources).
OK, that 5% interests me. But as a scientist I believe in
verification. Anybody get infected by that 5%, and by what, did it
have a name?
***
Conficker (fairly recent) was (is) an exploit based autoworm. There is
the lag time (zero-day effect) from the time the vulnerability is first
exploited, to the time the patch is applied. Its *intent* seems to be to
annoy you into purchasing something. Using a botnet to keep itself
current, it is much more powerful than that - we were lucky - this might
change.
***
The only thing I can think of is: (1) unnamed viruses
not get discovered by Kaspersky or whoever, and, (2) zero-day attacks
by new viruses (or variants of old) that Kaspersky sends out the patch
but a day late.
***
Yes, there is a lag time also between the analysis of the malware (not
the exploit) and the distribution of the signature obtained from the
analysis (another zero-day effect, this time for the particular malware
now utilizing that exploit. It is not called a "patch" though, usually a
definitions file or signature file (sigfile).
I can't provide you with anything that supports the "trusted channel"
vector except to mention that Energizer USB Charger software trojan.
There have been others, viruses IIRC, on distribution CD for harddrives
and such, but no URLs for you.
***
