But all these still require a hole in the OS to launch the initial program
I don't understand how it encrypts itself, it has to run to encrypt itself, so can't antivirus programs just get the signature of the first program?
Perhaps the next step is for antivirus programs to automatically sandbox all programs that aren't whitelisted so that if one does become a virus, the antivirus can just delete the sandbox.