Last person to catch on to Sony DRM

[kisrum]

Please don't hurt me. Must have been asleep over Christmas. My daughter received a Natasha Bedingfield (who?) CD over Christmas and in order to improve our enjoyment of this white-bread crap she played it on our computer.

I ran Symantec's First4DRM removal tool and it indicates it removed the files and registry changes, and I-Tunes will actually play other CDs again, but when I look at my "Processes" I see that the sys$DRMServer.exe is still there using up 2824 K of mem. When I redownloaded the removal tool it indicates that it removed the files and registry changes again.

The symantec website says:

"Symantec Security Response strongly recommends installing the software update provided by the manufacturer. The latest version removes the security risk from the compromised computer and replaces it with an updated version of the XCP software. This update is available at the following URL:"

Is that just Symantec putting forth the Sony company line, or is there something else I need to do?

Sony says:

You may either:
Update the XCP software on your computer. This option installs an update which removes the component of the XCP software that has been the subject of public attention and will alleviate concerns you may have about the software posing potential security vulnerabilities. It will also enable you to continue using the protected disc(s) on your computer.

Completely uninstall the XCP software and associated content protection files. This option will remove all XCP and associated content protection files, including service/processes, registry entries and folders from your computer. Note that once you delete the XCP content protection software, if you wish to play a CD protected with XCP it will be necessary to reinstall the XCP software in accordance with that CD's End User License Agreement after you insert the disc into your computer."

I'm more than happy to completely uninstall. Any problems with that? I haven't heard much of Ms. Bedingfield around the house.

[Poppa_Meth]

I'm not too up to date with this but that last I heard about it, in order to completely remove every trace of the rootkit from the PC a reformat and reinstall of Windows is the only fix.

[isogonic]

the unnstallers provided by AV companies only removed parts of the rootkit.

read this, 4th paragraph down;
http://www.sysinternals.com/blog/2005/11/sony-no-more-rootkit-for-now.html

or;

http://news.com.com/Microsoft+will+wipe+Sonys+rootkit/2100-1002_3-5949041.html?tag=nefd.top

[ROF]

Do a search of the forums here. I'd repost my results of the extensive personal knowledge I have about this rootkit and the horrors of the uninstallation process publicly but when I do it seems to bring out the trolls of the forums here.