Microsoft is cleaning up Sony's DRM mess amid fears that the rootkit could be used for malware purposes. The rootkit, a component of the controversial DRM scheme used by Sony BMG Music Entertainment, was discovered in October by Windows analyst Mark Russinovich who published his findings in his blog at SysInternals.com. Microsoft has taken the move of updating its Windows AntiSpyware application to add a detection and removal signature for the rootkit features used in the XCP digital rights management technology.
According to Jason Garms, group product manager in Microsoft's Anti-Malware Technology Team, the rootkit removal signature will be pushed out at Windows users through the anti-spyware application's weekly signature update process.
Detection and removal of the XCP rootkit will also appear in Windows Defender, the next version of Windows AntiSpyware when that makeover ships.
Microsoft plans to include this signature in the December monthly update to the Malicious Software Removal Tool.
News source: Eweek.com
According to Jason Garms, group product manager in Microsoft's Anti-Malware Technology Team, the rootkit removal signature will be pushed out at Windows users through the anti-spyware application's weekly signature update process.
Detection and removal of the XCP rootkit will also appear in Windows Defender, the next version of Windows AntiSpyware when that makeover ships.
Microsoft plans to include this signature in the December monthly update to the Malicious Software Removal Tool.
What's new in 0.4.0
- Added: Firefox 1.5.0.* compatibility
- Added: (fr-FR)French localization - Webgraph
- Added: (pt-PT)Portuguese localization - tiagosilva29
- Added: (es-ES)Spanish localization - Louis
- Added: Options window
- Added: Toolbar button customisation
- Added: Neowin link on Neowin.net logo context menu
- Added: Toplist button; but set not to show by default
- Added: NFiles button; but set not to show by default
- Added: PowerUser.TV podcast website button
- Added: PM notification concept design to options
- Added: Working search for Neowin using Neowin's search function
- Added: Working search for Neowin using Google
- Added: Search history for search box
- Added: RSS Icons for all RSS feeds
- Added: Customizing Windows Vista and its subforums to the forums menu
- Added: Neowin Clans & Game Servers to Gamers' Hangout in the forums menu
- Added: Vista Beta Place to Windows Beta Discussion in the forums menu
- Added: Longhorn Server Beta Place to Windows Beta Discussion in the forums menu
- Added: Fantasy Sports to The Sporting Arena in the forums menu
- Fixed: When selecting which buttons not to show on the toolbar; restarting Firefox will add them again
- Fixed: Clicking Neowin IRC Chat produces two error dialogs instead of one when the user has no IRC client - tiagosilva29
- Fixed: When you click any button and the website times out you get two error dialog
- Fixed: Options menu not showing/greyed out in the Extensions window - Yochanan
- Fixed: Improved RSS feed selection responsiveness
- Fixed: Duplicate search terms in search box
- Fixed: Removed dotted focus borders on checkboxes and buttons
- Removed: Deprecated code from the toolbar
- Removed: Double clicking neowin toolbar logo will now open Neowin.net frontpage in a tab
- Removed: Customizing Windows 98SE/ME/2000 in forums menu (Forum no longer exists)
- Changed: Extension location on my website so that I can provide the updates better in future
- Changed: Cleaned up alot of the code and made more organized
- Changed: All Neowin logos to the version 5 logos
- Changed: Version number format now compatible with the new Firefox 1.5 standards
- Changed: Neowin.net Home Page menu item now opens in existing tab instead of opening a new one.

Console wise (EG: MS is delivering while Sony isnt...)
This IMO is more over the console war....MS just wants to get more and more fans for their console.
Sneaky
Is there any on the forum who is a resident of the state of Georgia. Please reply!
Don't know if they are screwed, but at least a damage to their reputation has been done
I think it is good that they are providing a removal tool, though. Don't get me wrong.
Unless Sony cleans up its act and stops its Content division (movies, music) from including this crap and colluding with its electronics division with unfair restrictions (see MiniDisc player for one), then I will continue my Sony boycott. That and they're using increasingly cheap components. Sony stuff for me lasts less as long as other products. Makes me wonder why they charge the Sony premium.
Now here's someone who clearly doesn't understand the issue. Let's break down your comparison here:
Sony Rootkit
A secretly installed modification to the kernel environment that attempts to deceive the user by hiding the existance of malicious file and registry objects. It uses invisible proxy device drivers to intercept accesses to your CD drive. Attempting to remove it can render your PC unuseable, or leave your CD drive inaccessible.
ActiveX
A publicly documented API for building componentized applications. It was an evolution of the original OLE 2 technologies that were built on COM. A vast majority of Windows applications are built on ActiveX/COM.
Yeah, I could see how you could confused the two
Grow up.
My post clearly questioned the general blanket reason that was offered for the decision to target and remove the Sony DRM software.
Really, "it could be used for malware" applies to just about everything! I made no questioning nor disparaging remarks in regards to ActiveX, Windows, or Microsoft Corporation.
Now, relax a bit...
But you didn't provide any basis for questioning why Microsoft is helping users to remove the rootkit. The original article never said that the reason was "because it could be used for malware purposes." That was added by the Neowin editor who posted the story.
The reason for removing it isn't because it "could be used for malware purposes" - but because it is by its very nature malware.
No. The DRM is being used by OTHER people's processes to hide themselves. It is a tool that is being used/abused.
DRM is not malware.
Too bad I don't buy much music (apart from what I consider 10/10 or if it is rare).. so I'll never get this rootkit crap.
For your information, this is a move on the part of Sony BMG, which is under the name of Sony, however remain a seperate branch devoted only to music.
Then look at the other side of it. Who makes standalone home theater systems, DVD players, etc? Sony. They don't want their hardware becoming obsolete either. You can bet they won't cripple their own hardware if PCs remain fully-functional.
I think that any disdain for restrictive licensing should be addressed to the content providers (for example, the RIAA), and not Microsoft. That is except of course for Microsoft's own software licensing. But I'd say that's a seperate issue entirely.
Lol, that made me laugh. Thanks.
No, Microsoft is far from being "about choice". That is why they have been sued for anti-trust more than once.
Microsoft is in this for their own self interest. Broken computers, whatever the cause, do not look good for Microsoft. This is especially true if the cause is due to a security hole. The Sony DRM presents a security hole and Microsoft aims to fix it.
No, Microsoft is far from being "about choice". That is why they have been sued for anti-trust more than once.
Microsoft is in this for their own self interest. Broken computers, whatever the cause, do not look good for Microsoft. This is especially true if the cause is due to a security hole. The Sony DRM presents a security hole and Microsoft aims to fix it.
What does "sued for anti-trust" mean exactly? Yes, 10 years ago Microsoft was found to be a monopoly (not necessarily a bad thing) and was bound by restrictions that prevent Microsoft from directly leveraging that monopoly to manipulate other markets.
But that has nothing to do with Microsoft's position on DRM technology.
You're right about why Microsoft is removing Sony's trash. Because it's good for Microsoft's customers. Because doing things that are good for the customer will only help Microsoft.
However, my comment about Microsoft's position on DRM (that Microsoft supports choice for both content providers and consumers) was in reference to the above 2 commentors who were discussing Microsoft's position on DRM, not the article itself.
And I stand by those comments. Microsoft provides content providers the option of restricting use through DRM. But they don't encourage or discourage them from doing it. Microsoft is also about choice for the consumer. That's why Microsoft's DRM platform can be licensed for use on any device or platform (unlike Apple's FairPlay, for instance).
It's in Microsoft's interest to make their DRM platform as flexible and pro-user as possible (while still appeasing the content providers). It's a difficult balance, since the interests of content providers and users are often not aligned.
Even so, I might normally have been inclined to buy this or that Sony item if, for example, I found something half-way decent on sale. But now that they've shown that they can't be trusted, I wouldn't touch any of their stuff on a bet.
Screw 'em.
But it's their media divisions (Sony BMG and Sony Pictures) that worry me. They're both part of industry conglomerates that seem to care very little for their consumers, with little or no competition to challenge them or keep them honest.
dam thee Sony
Microsoft kicks ass!
They should have said no that way Sony would have to release a removal tool themselves which would be a big embarrassment for them.
This way there almost getting away with it, what’s next a Microsoft hotfix to stop it installing?
Go, Sony, Go!
(I can't wait to see what goodies the PS3 will bring us!)
i still can remember how sucky their customer services are.
"i am sorry, becuz u r not using SONY's windows xp professional cd, i can't help u"
"*(&&#(*&$#"
I've been impressed with Microsoft lately... they are really improving as a company.
Sony is going down for sure.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.