Sony Rootkit

  • Thread starter Thread starter Rusty
  • Start date Start date
Thanks--finally got the link read, and the devil is in the details.

If you have had this Sony software on your machine, you need to read this
link, and visit the codesupport detection page link provided.
 
Conner said:
More reading.. which also includes Rusty's link..
http://blogs.washingtonpost.com/securityfix/2005/11/multiple_securi.html
Click to expand...

Following those links, (Thanks Conner) I found that the ActiveX control used
to uninstall the Sony DRM software remains on the user's system and allows
*any* web page to download and execute *any* software. I sincerely hope
someone will identify this ActiveX control as soon as possible so it can be
removed. It doesn't get more serious than this.

Meanwhile here's what we get from Sony:
http://cp.sonybmg.com/xcp/english/uninstall.html

November 15th, 2005 - We currently are working on a new tool to uninstall
First4Internet XCP software. In the meantime, we have temporarily suspended
distribution of the existing uninstall tool for this software. We encourage
you to return to this site over the next few days. Thank you for your
patience and understanding.

Bob Vanderveen
 
Bill Sanderson said:
Thanks--finally got the link read, and the devil is in the details.

If you have had this Sony software on your machine, you need to read this
link, and visit the codesupport detection page link provided.
Click to expand...

Would it make sense for MSAS to block this class id:
"CLSID:4EA7C4C5-C5C0-4F5C-A008-8293505F71CC"?

Bob Vanderveen
 
OK, Microsoft AntiSpyware Beta1, hold the presses... Don't release that rootkit
killer just yet... I'm in the Sony rootkit cleaning business... Now who wants it
removed?... I ain't cheap, but I can do it in say...ummm, 15 minutes, max...
willing to travel... your nickel.
 
Looks like we'll have opportunities to reformat hard drives, reload windows
and all the software too - plenty of dollars to be made here!
 
Back
Top