Once loaded, an attacker could potentially change passwords, access protected files, or do just about anything else remotely and then leave without a trace. Unlike most exploits out there, VBootkit 2.0 can't be installed remotely, so an attacker would need physical access to a machine in order to compromise it. Moreover, rebooting the computer gets rid of the security threat, as system memory is cleared during the process.
Its severity is debatable, then, considering it can’t automatically spread through the web. However, it could be a concern for businesses and people using computers in public places. Microsoft hasn't commented on the exploit, but its creators say the problem stems from Windows 7’s assumption that the boot process is immune from attacks. It’s a design problem, they claim, one that cannot ever be fixed.