sony rootkit question

From what I read, it looks like it does move across networks so I wouldn't doubt that is how it got on your secure machine. It looks like the windows malacious removal tool takes care of the rootkit, and MS Anti-Spyware does as well...

http://www.boingboing.net/2005/11/17/sony_rootkit_roundup.html

http://www.boingboing.net/2005/11/15/sony_infects_more_th.html

I don't agree. The rootkit (by itself) is not network aware - other than reporting user information back to Sony. This is what causes the rootkit related DNS queries that josh's links point too.

From my analysis of the software, it installs only locally on the $sys$ and then watches OS calls related to the CD (for example trying to play the CD using windows media player).

However, if there is a piece of malware or virus that exploits the rootkit - this could be what you are observing.

It's most likely someone popped the disk in this system since Sony started making the disks earlier in the year.

The sony rootkit is installed and only installed if you play one of the music cd's that incorporates the copy protection.

As it installs the player it puts the rootkit on.

The first removal patch that sony issued actually caused more problems than it cured. It will kill windows.

This page has a bunch of links to good information on this windows killer.

http://tinyurl.com/bgejl

For the most amazing breakdown of this rootkit check out this blog.

http://tinyurl.com/auyjl

More reading on the subject. Including a list of cds that will infect you.

http://tinyurl.com/cdwze

Is there a saving grace? Yes!

Believe it or not Microsoft to the rescue?

http://tinyurl.com/bmw8g

All of this is just another reason to control the content that is put into a companies computers.

Good Luck

Lee

Turns out it wasn't the SONY problem. A burning program on this one system crashed and left a file behind that was causing our problems.

Thanks for your responses and all the reading material.

Tim

This question was closed by the author