Pot calling kettle....come in kettle.....

Before installing any freeware always read the EULA most times it will say what information is sent back to the "central" servers for their information. From my experience about 90% of freeware contains some reporting functions, typically IP address, user id and data concerning use of the product.

This was another over reach by yet another company who has been caught with their collective hands in the cookie jar.

Had this been a first rate rootkit, it wouldn't have been found so easily. This is hardly the work of 'HolyFather'. An online moniker for an individual purporting to be from the Chezck Republic. A renown rootkit writter that even F-Prot seems to share some admiration. F-prot as you probably know writes the best (atleast known by myself) commercial rootkit scanner (blacklight)out there and has said they will likewise remove the kit. CA and Symantec have likewise said they would remove the kit as well. Haven't seen anything from McAffee or Trend but they will probably wait for the fireworks/legal action to cease first.

As far as any other stealth kits? If they are truely stealth then the secrets still with them. I have caught software calling home using DiamondCS Port Explorer (PE). Cost me a few hours on the phone with Trend but we did find the 'tard on the computer and the next release had a new update because of it. SysInternals, I forget the gent who writes the software, is another excellent product. Probably better than PE but who knows.

Let me drop in to the Wilder's forum and ask. If anyone knows of something secret they will be more than happy to shed some new light but chances are I'll get a bunch of remarks about: 'Back in the day we had/I saw...'

I'll keep ya posted.

- beads

Start with good ol' MS or anything that leaves cookies behind. You've heard of "tracking cookies", haven't you??? Watch out for "instant messaging" they're rife with them. ;\

[b]Dawg[/b] ]:)

just prior to the release of service pack2for windows XP,I was victimized by a peice of software that I have yet to identify, not any kind of known virus,or worm .I belive that it was some type of root kit possibly similar to the ones you have mentioned ,i have every reson to belive that indeed thats what it was,every time I logged on to my machine someone else would log on with me ,they has the ability to do most any thing they wanted, including un-install some of my programming and ,install programming of their own, with passwords,the net result of this was I had to format my drive to get rid of the stuff, i belive this software is still out there and may be modified/upgraded if i am correct there are a lot of affected machines out there,and their owners may not even be aware of it.

So now Microsoft is at fault for Real Network's Real Player? WTF.

What does every topic on TechRepublic denigrate into

(1) Microsoft sucks-Linux is the Messiah
OR
(2) Everyone but me is stupid (managers, other IT people, users...)

Doesn't anyone in the world have an original thought?

(Yes I know this post falls under #2 above)

There is a thread on Doom 9's site, that discusses this issue. Last I read, sony has released a kit that removes this DRM software from your computer. I've also heard that there will be a DRM protest, but that it got delayed. My problem with all this, is that the companies are wasting money on all these fancy protection schemes; all of them get cracked after a while. The old rule goes, if a human did a the copy protection, a human can crack it. I've heard of other stealth software out there, but that is why I have my firewall. Anything that is suspicious, I will not let it access the net, and I NEVER let real player access the net, cause after it does the first time, you get endless nags about this that and the other :( My computer is NOT a running commercial, thank you very much :) So now you have my take on this.

There are a number of Federal Laws that make spyware illegal. One is the Secrecy of Communications Act of 1933. These 'bugs', 'data miners', etc are Federal Offenses. It's on the same level as bugging your phone without a warrent! It's time to quit looking at them as 'irritations' and file charges with the FBI! You have the Constitutional right to be 'secure in your property and papers'. Let's start filing the charges and law suits and enforce our right to fair use.

Maybe I've missed some recent takeover news, but MS do not own or supply Real Player......

In fact that malicious piece of crap is owned and distributed by Real Networks:

http://www.real.com/international/player/?src=realplayer

It's also funny, given the fact that Real has run to the courts many times complaining about competition from MS.

Ironically the only reason I ever installed the thing was because the BBC Online only supported Real.

With regards to MS their media player is Media Player. As far as I can see you are, at installation and later, given the choice not to send information back to MS.

Microsoft is not responsible for Sony and RealNetworks/RealMedia's sucking up to the perversions of DRM. But Billy Gates could have built a less vulnerable OS, and foregone the lousy 'activation' garbage making recent Windows versions less friendly...

DRM should be outlawed as an illegal invasion of privacy. 'Defective Restricted Media' is an appropriate reworking of the abbreviation. Likewise, the 'Digital Millennium Copyright Act' is a fraud and scam, and should be stricken as wholly inappropriate. The 'music industry' should be sued into oblivion over half a century of scamming musicians and listeners, and their lackeys (like Sony and RealMedia/RealNetworks) should go down with them.

I have banned RealOne/RealPlayer from my system, and advocate using codec packs with WinAmp, Windows Media Player, MusicMatch, and RealAlternative Player to handle RM, RAM, and similar file types when no alternative can be had. I refuse to buy 'copy protected' CDs and promote 'fair use' of CD and DVD media with the only limits being license-count for the benefit of the artists or actual creators of media. 'Copyright' is fully acknowledged unless the claimant is an invalid such as the 'music industry'; 'copy protection' is universally rejected.

The following is a excerp from WinXP News, and EFF, The Electronic Frontier Foundation:
Is Your Technology Telling on You?
We've addressed various aspects of this issue before, and this week we'll put them all together. More and more, the machines that we use and depend on are collecting information about us. In some cases, they just store it for later access. In other cases, they actually report back to their makers (the product manufacturer). This information can and does find its way into the hands of the government and who know who else? Is this a problem, or just a way to make the world safer for law abiding citizens? Let's take a look at some of the ways our technology is telling on us.
It's been common knowledge for a while that several major printer vendors engineer their color laser printers to embed tiny yellow dots into the printed documents to make it possible to track the origins of the document. This was done in cooperation with the U.S. Secret Service for the ostensible purpose of tracking down counterfeiters who use the printers to make their own currency. Last month, the Electronic Frontier Foundation (EFF) was able to crack the code for Xerox DocuColor printers. Their researchers discovered that printers made by Xerox imprint the serial number of the printer and the date and time the document was printed.
Xerox isn't the only vendor using the technology; it's just the only one for which the code has been cracked. Other printer brands that embed identifying information include Canon, Dell, Epson, HP, Lexmark and others. Wondering if your color laser is telling the world (or at least, the U.S.S.S.) where and when your documents were printed? Here's a list of some of the brands and models that do:
List of Printers Which Do or Don't Print Tracking Dots
Help EFF Watch the Watchers. Join EFF today!
Last updated: October 13, 2005
This is a list in progress of color laser printer models that do or do not print yellow tracking dots on their output.
Remember that a "no" simply means that we couldn't see yellow dots; it does not prove that there is no forensic watermarking present. (For example, the HP Color LaserJET 8500 series does not include any yellow tracking dots that we can see, but it may still include some kind of forensic marking, since the majority of earlier CLJ models did.)
Remember that a "yes" simply means that we (or another source, as noted) saw yellow dots that appeared anomalous to us. Until we decipher the marking schemes or receive other confirmation, this does not constitute proof that any particular kind of information is represented by these dots. In a very few cases, for example, they might be the result of a poor dithering technique, rather than a forensic mark.
Thanks to our friends at software firms and symphonies, public schools and physics labs, semiconductor fabs and ice cream parlors, in about a dozen countries around the world.
We use the following codes to indicate the source of this information.
[exp] = EFF looked at printer output under a blue light
[mfr] = manufacturer said printer prints tracking codes;
[press] = press report said printer prints tracking codes.
Brother yes
? HL-4200CN [exp]
Canon yes
? CLC 1000 [exp]
? CLC 2400 [exp]
? CLC 4000 [exp]
? Color imageRUNNER C3100CN [exp]
? Color imageRUNNER C3200 [exp]
? Color imageRUNNER C3220 [exp]
Dell yes
? 3000cn [exp]
? 3100cn [exp]
? 5100cn [exp]
Epson AcuLaser yes
? C900 [exp]
? C1100 [exp]
? C1100 [press]
? C1500 [exp]
? C1900 [exp]
HP Color LaserJet no
? 2250ln [exp (??)]
? 4500 [exp]
? 4500dn [exp]
? 4500n [exp]
? 4550 [exp]
? 4550n [exp]
? 5M [exp]
? 8500 [exp]
? 8550 [exp]
? 8550dn [exp]
? 8550gn [exp]
HP Color LaserJet yes
? 1500l [exp]
? 2500 [exp]
? 2500n [exp]
? 2550l [exp]
? 2550n [exp]
? 2600n [exp]
? 2680 [exp]
? 2840 [exp]
? 3500 [exp]
? 3500n [exp]
? 3600dn [exp]
? 3700 [exp]
? 3700dn [exp]
? 3700n [exp]
? 4600 [exp]
? 4600dn [exp]
? 4600hdn [exp]
? 4600n [exp]
? 4650 [exp]
? 4650dn [exp]
? 4650dtn [exp]
? 5100cn [exp]
? 5500 [exp]
? 5500atn [exp]
? 5500dn [exp]
? 5500hdn [exp]
? 5550 [exp]
? 5550dtn [exp]
? 9500 [exp]
? 9500hdn [exp]
IBM unclear
? Infoprint Color 1454 [exp] {dithering algorithm?}
Konica/Minolta unclear
? DialtaColor CF 2001 [exp] {dithering algorithm?}
Konica/Minolta yes
? Bizhub C350 [exp]
? CF1501 [exp]
? Colorforce 8050 [exp]
? Desklaser 2200 [exp]
? DialtaColor CF 2001 [exp]
? Ikon CPP500E [exp]
? Magicolor 2210 [exp]
? Magicolor 2300 DL [exp]
? Magicolor 2430 DL [exp]
? Magicolor 3300 [exp]
? Magicolor 7300 [exp]
Kyocera yes
? FS-C5016N [exp]
Lanier yes
? LD238C [exp]
? LP125cx/LP126cn [exp]
Lexmark no
? C720 [exp (??)]
Lexmark yes
? C510 [exp]
? C720 [exp]
? C912 [exp]
Minolta: see Konica/Minolta Oki/OkiDATA no
? C5150 [exp]
? C5150n [exp]
? C5300 [exp]
? C7200 [exp]
? C7350 [exp]
? C9300 [exp]
Ricoh: see also Savin Ricoh yes
? Aficio CL 3000 [exp]
? Aficio CL 6010 [exp]
? Aficio CL 7000 [exp]
? AP 206 [exp]
Samsung no
? CLP-510 [exp]
? CLP-500 [exp]
? CLP-550 [exp]
Savin yes
? C3210 [exp]
? CLP35 [exp]
Tektronix: see Xerox/Tektronix Toshiba yes
? eStudio 210c [mfr]
? eStudio 310c [mfr]
? eStudio 311c [mfr]
? eStudio 211c [mfr]
? eStudio 2100c [mfr]
? eStudio 3100c [mfr]
? eStudio 3511 [exp]
? FC15i [mfr]
? FC15 [mfr]
? FC22i [mfr]
? FC22 [mfr]
? FC25Pi [mfr]
? FC25P [mfr]
? FC70 [mfr]
Xerox yes
? DocuColor 12 [exp]
? DocuColor 40 [exp]
? DocuColor 2045 [exp]
? DocuColor 2000 [mfr]
? DocuColor 6060 [mfr]
? DocuColor 6060 [exp]
? WorkCentre M24 [exp]
? WorkCentre Pro all models [press]
? WorkCenter Pro 40 [exp]
? WorkCenter Pro C2636 [exp]
Xerox/Tektronix Phaser no
? 560 [exp]
? 740 [exp]
? 750 (Z750V) [exp]
? 750P [exp]
? 780 [exp]
? 850DP [exp]
? 860DP [exp]
? 6100 [exp]
? 6200 [exp]
? 6200DP [exp]
? 6250DP [exp]
? 7700 [exp]
? 8200DP [exp]
? 8200DX [exp]
Xerox/Tektronix Phaser unclear
? 8400B [exp?] {dithering algorithm?}
? 8400DP [exp]
? 8440DP [exp?] {dithering algorithm?}
? 8400DX [exp]
8400N [exp]

No defense of unethical practices by Microsoft intended, but Sony took it to the next level by cloaking with a root kit.

Does anyone know anything about MediaMax, one of the other DRM control software Sony uses?

At our company watched, we watched the net traffic while installing, and registering XP because there were rumors when it first came out that M$ was cataloging all the apps on the machine - M# or not - and collecting that info. Then they supposedly removed that code after the news media went nuts.

Apparently, they heat died down enough, and the code was put back in place. By logging all traffic from a machine, we've seen that a list of all installed apps is sent to M$ at the time of registration, and approximately once every 90 days after that. Each app includes the amount of disk space, it's S/N and it's frequency of use.

And no, we can't publish the data officially because of license restrictions.

Two points I'd like to voice about this incident, which the mainstream media has totally ignored:

1. Unauthorized use and damage of someone else's property (or about 500,000 peoples' property, depending on whose published numbers on the scope of this thing you're using) is ILLEGAL. Why have the Sony managers who originated and approved this fiasco not been identified and charged? Why are all the fame-hungry lawyers not jumping all over this? (And when are the artists whose music is involved going to jump labels over this?)

2. More than the fact that massive numbers of PCs are a) infected by this rootkit, b) open to other "piggyback" attacks, c) even more compromised by the "patch," what concerns me most (and what I've NOT seen mainstream media address) is the fact that BIG BUSINESS HAS ASSUMED THE RIGHT TO DO WHATEVER THEY WANT TO WHOEVER THEY WANT in the name of their almighty profits. Hello?! Does this arrogant presumption of absolute authority without regard for the law bother anybody? Does anyone remember a guy named King George and a little tea party?

My congratulations to Sony. You've done what even the courts of the U.S. have been unable to do. You have just made illegal downloading a legitimate way to acquire SAFE music.

Start upgrading your bandwidth, everyone. The deluge is on the way.

Anything that's not open source is 'stealth
software'. Run a decent sniffer on a Windows
machine and you'll be horrified by the amount of
chatter that goes on between your machine and
other places on the net.

Pull the plug, read the source.

Deg.

I worked for an E-Retail company. We are running a product from TeaLeaf technologies that allows us to recreate and view the user experience. We can actual view each page and click that the user did as though we were watching it live. If my small retailer can do this what does the NSA, FBI, etc have the ability to do not to mention just the average hacker. HMMM!

1. RealPlayer is not Microsoft

2. Tracking cookie information is not secretly tranmitted by a ROOTKIT that is not mentioned in any EULA or documentation as is the Sony bug.

As a side note, tracking cookies can be blocked and not accepted if you configure your cookie settings in IE or other browsers for that matter.

There's Gator and others. Just when you install a game or whatever, just check in the registry to see what else has been added. If you can't find it there, run Lavasoft SE or SpyBot Search & Destroy and you'll be able to find them.

To think that Micro$oft is playing the benevolent hero in this Sony fiasco is naive. Micro$oft is only positioning its spyware software, which is still free in beta testing, to overtake the anti-spyware market with a big feather in its cap at the expense of Sony's dim-witted, greedy management. Then charge a ridiculous amount of money for a restrictive license.

If Micro$oft were truly the benevolent hero and genuinely concerned about PC security, then it would remove its bug-ridden Operating System from the market. Or at least make Windows open-source so that the minds of those who are not polluted by the culture of corporate greed can combine their efforts to transform Windows into a safe, and efficient Operating System.

What would you do if somebody stole your personal information from your mailbox? Your filing cabinet? A vault or safe in your home?

My computer is in my home. Meddle with it at your own risk.

For those who have been in the Channel, and had a chance to use a SONY product, they know how slow they've been. It's because the content that resides on thier HD is HUGE and, yes, lots for stealthware. Of course nobody called it that 5 years ago did they..(;-))

Try using "Stealther v.2.7" By Photono Software Company. You can surf anything undetected.

with what open source systems are about. Look up peer review among other things that way you'll avoid looking completely silly in public again.

Open source is not called open because you can see it or change it, it's called open because you cannot hide what you have done !

install software by default?

many places prevent this unless you are admin, would have taken care of this or many other problems

Your ISP doesn't "know" anything, unless they've set up port sniffers to deliberately monitor their customers' traffic. The first ISP that would be stupid enough to do something like this would be the first ISP to go out of business and its owners brought up on charges the following day.

People should just take a deep breath and relax. There are no black helicopters hovering over your house. There are no agents in black watching you. Take a common sense approach -- kepe your PC secure and just live your life as you normally would. The only time you have to be worried about someone possibly "spying" on your activities is if you're doing something illegal.

http://www.sysinternals.com/utilities/rootkitrevealer.html
Boycot sony
remove the root kit

and are being brought up on charges; they read email of ISP customers, in particular a bookstore and somehow gained competitive advantage by doing something with it.

others may have tapped customer's data but not done anything with it so unknown.

[i]"does anyone know of any other 'stealth software' out there?"[/i]
If we knew about it, it wouldn't be stealth software. :D

Open source software holds no guarantees of security. Proprietary software's EULA's specifically make you agree that they are not responsible for anything bad that happens to you using their software. So either way you are flying solo. You hold sole responsibility for anything that happens to you either way.

Given all else equal, with the responsibility being mine and mine alone, I'd rather send my kids to a school that encouraged me to look around and meet the teachers any time I wanted, make sure they weren't on any pedophile lists, etc. than a school that forbade me to see anything but the brochure and just have to trust that they will be fine.

But I'd be happy to let you decide to which you would like your kids to attend. So both exist and some people don't care to know and some do.

Of course the NSA developed their own version of Linux. They did not choose to trust Microsoft to make them a secure version. Buut what does the NSA know about security anyway...

Maybe you haven't heard that the rootkit remover installs a spy program too. Its much worse than the one you are trying to remove. (it allows any program to download and execute code on your machine from anywhere on the web!)

I think you've missed the point here. It is much more difficult to hide a rootkit in OSS than in proprietary software without it being noticed.

And the major disservice is not calling OSS more reliable or secure, it is the proprietary software vendors claiming OSS creators legally have less responsibility for the end result of what they create and what happens to you when you use it.

But that is what's crap. Proprietary software for which you paid money also has no legal responsibility for what happens to you. RTFEula lately?

Just like no matter how many times Bush insinuated a link between Saddam and 9/11, they weren't related any more than you were to 9/11. It's a lie via insinuation.

Maybe not direct knowledge, but I know of ISPs who will cut your service if you have exceeded a certain amount of data transferred, or block ports they deem you are using for unapproved activities (p2p filesharing, for example). They can get by with this by putting the terms within your contract (If you don't like the terms, use another ISP), especially in small markets with no or limited competition.

Why would anyone ever have autoplay turned on? Now I realize that not all of us are "technically savy" but come on now! When autoplay is enabled you are saying to anyone who makes a cd, " I trust you completely. Whatever content is on this cd must be swell."
Recently we had a problem with the proxy on our network that was causing the MSN homepage to be 2 days behind. What an uproar this caused. "Today is the 8th. How come my home page is dated the 6th?" This goes to a a much larger issue. Americans are such media junkies. We are addicted to the crap that is pumped out of Hollywood, the networks, the recording industry, etc. And it is mostly garbage. Is it no wonder that they are slipping trojans, spyware and who knows what else into the mix?
Come on people wake up. I suppose if Microsoft sold cars you would all be driving micro-mobiles too! Just because the default installation includes the MSN homepage doesn't mean that you should want it or use it. The internet is about choices---multitudes of choices but most people don't think for themselves. You just blindly suck all this crap down and now you want to complain because they slipped you a little program that tries to control what you do on your computers. For too many of you all you want in life is to be entertained and you submit to these media conglomerates. What did you expect?
Now run along to the voting booth and surrender more of your freedoms.

The underground has my vote anyday.

Has no one been paying attention? The guvmint is working on a deal to track anyone anytime anywhere. They are setting it up that operating systems can be hacked by the Feds whenever they like--all in the name of Homeland Security, of course.

You ain't seen nothin' 'til you see what Big Brother REALLY has in store for us!

No matter how thoroughly you clean your hard disk..Data is still retrievable...

I saw ths documentary about crime busting once..FBI were able to get into this person's computer and bring up data several layers deep. Data that had been written in the same sectors in several layers.

Now if you are afraid of this...This is Paranoia...but unless someone is doing something illegal, who cares about this type of data recovering ??

I know I'm only one person, but when crap like this happens, I never purchase their products again. I've had some bad luck with a few Sony products before so now their on my NO PURCHASE list along with Ford cars (FIRE!) and stoned tires (Firestone and Bridgestone).

According to what I've read from the others, you can stop the cloaking but does anyone know how to get rid of the rootkit completely???

It all boils down to the expertise (or passion, as you put it) of the end user. Someone who is savvy has a lesser chance of being victimized by security breaches, malware, or viruses than one who is less savvy on the same platform.

Since the avreage Linux user is more savvy than the average Windows user, it is less 'profitable' to target them one to one, and even less because there are far fewer targets. People who claim Lunux has better security than Windows aren't taking these two things into consideration.

Were the tables reversed, i.e. Linux was running 90+% of the world's PCs, then we would in all liklihood be exactly where we are now, except the O/S in the hot seat would be different.

I have read an article in a british computer mag
(micro-mart). The article mentions that when microsoft brought out the beta version of thier spyware scanner, GAIN Gator was one of the spybots that it would find, since then microsoft have bought out the company (it was worth 500 million pounds)now all of a sudden their spyware detector does not find it or list it after a scan.
Spooky eh!
The article ends with the quote "as the gamekeeper turned poacher" .

It seems that just because I have a PC they seem to think they have the right to monitor me, you never know what information these people keep about you. If Hitler was around today we would have all been rounded up by now,intellectuals usually first. I am seriously thinking of getting rid of this spy in my living room and just reading a book its safer.
And before anyone says "if you are doing nothing wrong you have nothing to worry about" (well You would be worried if you lived in China).

quality software costs more to produce (a lot more) and so hit's your profits.