Even if you could find the hidden copy protection components yourself, computer experts warn against trying to uninstall it without help. Trying to do remove it without official instructions could damage the computer, rendering the CD drive inoperable.
Sony's Web site has a downloadable patch which will remove the ability of the copy protection software to hide from view, but will not uninstall it.
To uninstall the software completely, a user must fill out a separate customer service form on Sony's Web site, asking for instructions on how to uninstall the rootkit software.
How do the new Trojan horses piggyback on Sony's software?
The Sony software hides itself very well on a computer, but allows other software to use the same technique. Essentially it establishes a new rule at the level of the operating system that says any software that starts with the string of characters "$sys$" should be hidden from view.
Virus writers quickly took pre-existing malicious software and put those characters at the beginning of the relevant code, making their work invisible on any computer that had the Sony copy protection installed.
What do the new viruses do?
So far, the ones that have emerged hide themselves, then open a channel to the IRC chat network. An attacker could use that back door to control the computer completely, using it to send out spam, launch attacks on other computers, or many other nefarious tasks.
Will antivirus software stop this?
The problem with rootkits is that they can hide themselves even from antivirus software. However, most of the big antivirus companies are working with First 4 Internet and Sony to break through the rootkit's invisibility and identify anything hidden by the Sony software. That means most antivirus protection will be able to identify and remove the Trojans.
As always, it's important to keep antivirus software updated, or it won't be able to find these new problems.
Do all copy-protected CDs have this problem?
No, the majority does not. Most of Sony's copy-protected CDs use a different technology from a company called Sunncomm, which does not present the rootkit security issues. In other countries, many copy-protected CDs use technology from Macrovision, which also uses a different technique.
Which CDs are dangerous, then?
The Electronic Frontier Foundation is keeping a list of CDs that seem to have the First 4 Internet software included.
If you're buying a CD, look on the back for a little box labelled "Compatible with." If that includes the Web address "cp.sonybmg.com/xcp", then it probably has the rootkit software included.
Is what Sony did legal?
Copy-protection software by itself is perfectly legal. However, at least one class-action lawsuit has already been filed against Sony in California, asserting that it violated state and federal statutes against computer tampering, trespass, fraud and false advertising. Several other lawsuits are expected. Italian consumer groups have also called for criminal investigation and potential legal action, although the discs were primarily distributed in the United States.
2%
4%
Okay, so I have one of the "culprit" CDs and I have burned it to my PC (Windows). How do I know if my machine has created the vulnerability?
According to this report (http://www.eff.org/deeplinks/archives/004144.php), at least one of the CDs is "labeled as XCP, but, oddly, our disc had no protection," I find myself wondering how in the world I check my machine to see if it's there!?
Any suggestions are appreciated!