Integrity Protection Driver stops attackers from installing some kinds of root kits (root kits are used to hide an attackers presence on a compromised system).

However Integrity Protection Driver doesn't load until 20 minutes after boot, if an attacker changes the system time he/she is able to bypass Integrity Protection Driver and install the root kit anyway.

Also information has been released about how to circumvent the protection of \Device\PhysicalMemory, by using the kernel function NtCreateSymbolicLinkObject to create an alternate name for \Device\PhysicalMemory, it is still possible to access it.

Solution
There isn't any easy workaround, also a malicious person can cause a lot of trouble even if he can't install his rootkit, he may even be able to uninstall Integrity Protection Driver.
Further details available to Secunia VIM customers

Provided and/or discovered by
The time issue was discovered by Jan K. Rutkowski
The \Device\PhysicalMemory issue was described in Phrack

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers