Listening to Sony music on your Windows PC considered harmfull...

[Tony]

Sony rootkits-and digital rights

Quite an interesting read, especially in conjunction with Scarecrow Man's thread about Rootkits!

Tony

[andsome]

That lot is much too testicle for me to understand.

[Scarecrow Man]

Rootkits ARE dangerous, though some are there for a reason. A Rootkit is essentially something hidden from the Windows API. If it is hidden, programs like anti-virus will not see it. As I stated before, please use F-Secure's BlackLight to scan for dangerous Rootkits. This program is still in BETA so it is free to download until January 1st 2006.

[catgate]

I find this all very sinister. Surely there must be some "invasion of privacy" going on? Or have the legislators for such things sunk to this sort of deapth themselves. Is this the purpose of the Gates largess?

[dagwoood]

Sony are now offering s/w to patch this rootkit, but all it does is stop the hidden files from being hidden The Register.

What I find more worrying after reading the article Tony provided the link for is that the code was written so badly that malware could be written to exploit it.

[dagwoood]

Well, further to my post yesterday and voicing my concerns about someone exploiting the Sony rootkit, it seems gamers have already been using it to cheat in on-line games The Register.

If they can do it so easily, what's stopping anyone else exploiting the Sony code?

[Besty]

I have to say i agree with andsome on this one :huh:

[andsome]

Rootkits ARE dangerous, though some are there for a reason. A Rootkit is essentially something hidden from the Windows API. If it is hidden, programs like anti-virus will not see it. As I stated before, please use F-Secure's BlackLight to scan for dangerous Rootkits. This program is still in BETA so it is free to download until January 1st 2006.

Can this be right? I just used this to scan, and it finished in eighteen seconds.

[CurlyWhirly]

That lot is much too testicle for me to understand

Have a look here http://www.grc.com/SecurityNow.htm

Check out Episode 12 which is directly related to this topic.

You may also want to check out Episode 9 as well.

Can this be right? I just used this to scan, and it finished in eighteen seconds.

Yes I downloaded it yesterday and it also only took a short time to complete it's scan.

Fortunately my PC was clean.

[andsome]

I downloaded and ran Rootkit Revealer, out of curiousity. I almost wish I hadn't, I am now very confused. It revealed 255 DISCREPANCIES. It does not tell me what they mean and the help page is not available on line. My computer seems to me to run perfectly, and I never download music at all. The only music that I listen to on the computer is from a CD, or from Classic FM on line. Below is a sample of what came up.

[Tony]

Here is the link to the "Service pack" Sony have released to remove this

http://cp.sonybmg.com/xcp/english/updates.html

From the web page

This Service Pack removes the cloaking technology component that has been recently discussed in a number of articles published regarding the XCP Technology used on SONY BMG content protected CDs. This component is not malicious and does not compromise security.

[bvw]

Scan complete.

No items found.

:)

[CurlyWhirly]

I downloaded and ran Rootkit Revealer, out of curiousity. I almost wish I hadn't, I am now very confused. It revealed 255 DISCREPANCIES. It does not tell me what they mean and the help page is not available on line. My computer seems to me to run perfectly, and I never download music at all. The only music that I listen to on the computer is from a CD, or from Classic FM on line. Below is a sample of what came up.

That's strange as when I ran the test I didn't get any hidden entries :huh:

I don't think you get the Sony rootkit from downloading music from the internet but from playing music CD's that incorporate this technology into the CD itself.

[andsome]

I downloaded and ran Rootkit Revealer, out of curiousity. I almost wish I hadn't, I am now very confused. It revealed 255 DISCREPANCIES. It does not tell me what they mean and the help page is not available on line. My computer seems to me to run perfectly, and I never download music at all. The only music that I listen to on the computer is from a CD, or from Classic FM on line. Below is a sample of what came up.

That's strange as when I ran the test I didn't get any hidden entries :huh:

I don't think you get the Sony rootkit from downloading music from the internet but from playing music CD's that incorporate this technology into the CD itself.

Any idea what all those items mean?

[CurlyWhirly]

Any idea what all those items mean?

Well if you extend the Path box as shown in my screenshot, it may reveal a bit more info!

[Guest be@vis]

andsome - read this page, it may help you - http://www.sysinternals.com/Utilities/RootkitRevealer.html

[andsome]

Any idea what all those items mean?

Well if you extend the Path box as shown in my screenshot, it may reveal a bit more info!

My screen shot looks the same as yours, what else do you want to see. That is exactly as it was. I am at present doing another scan so that I can see if it possible to show more. I will post it when it is done.

[andsome]

The second scan was similar to the first one. I cannot show any more than is already shown.

[Guest be@vis]

What Curly Whirly means is for you to extend the boundary between "Path" and "Timestamp" so that it's possible to read the full path of each file.

[andsome]

What Curly Whirly means is for you to extend the boundary between "Path" and "Timestamp" so that it's possible to read the full path of each file.

I think I see now. I will do another scan, the last one would not save.

[Guest be@vis]

Try downloading, and using, "Rootkit Revealer" from Sysinternals, see what that says. If you use it it takes a long time to do it's first scan and, before using it, go to "options" and tick "Hide standard NTFS metadata files" and "Scan registry".

[andsome]

Try downloading, and using, "Rootkit Revealer" from Sysinternals, see what that says. If you use it it takes a long time to do it's first scan and, before using it, go to "options" and tick "Hide standard NTFS metadata files" and "Scan registry".

The above scan is from Rootkit Revealer, and is what I using to scan right now. I will do as you say and hide what you suggest, and do another scan.

I extended that boudary and most of the things show were in Temporary Internet files, so I have not posted this scan.

I will try be@vis suggestion and do another scan.

[Guest be@vis]

I don't think there's too much to worry about. If they're temporary internet files Rootkit Revealer wouldn't see them as "normal" system files so it would report them (I think - crossed fingers).

[andsome]

I don't think there's too much to worry about. If they're temporary internet files Rootkit Revealer wouldn't see them as "normal" system files so it would report them (I think - crossed fingers).

Scan is still running and is still blank. So if these other things are not true problems why are that allowed to show as problems? Why not remove the two options which I have now not allowed?

Scan has now copleted, but I cannot drag and highlight to save and post. When I tried File save I got an error, offering to report the error to Microsoft. A whole load of temp internet files also still showed up. I will try yet another scan and print screen. Time is now running out as I MUST watch the local team on TV in the cup. :D

[Guest be@vis]

"Why not remove the two options which I have now not allowed?" - Do you mean "Hide standard NTFS metadata files"? If you untick that option you'll get a long list of hidden files which are used by Windows. The temporary internet files show up as they are not recognised as "standard" OS or program files. The time to worry is when you have no provenance for a file - i.e. "ABC.exe" turns up in the scan and you know that you don't have a program called "ABC" on your PC.