main

Microsoft to remove Sony DRM 'Rootkit'

chicken-royal   on 13 November 2005 - 23:14 · 65 comments & 6327 views

Advertisement (Why?)
Microsoft is cleaning up Sony's DRM mess amid fears that the rootkit could be used for malware purposes. The rootkit, a component of the controversial DRM scheme used by Sony BMG Music Entertainment, was discovered in October by Windows analyst Mark Russinovich who published his findings in his blog at SysInternals.com. Microsoft has taken the move of updating its Windows AntiSpyware application to add a detection and removal signature for the rootkit features used in the XCP digital rights management technology.

According to Jason Garms, group product manager in Microsoft's Anti-Malware Technology Team, the rootkit removal signature will be pushed out at Windows users through the anti-spyware application's weekly signature update process.

Detection and removal of the XCP rootkit will also appear in Windows Defender, the next version of Windows AntiSpyware when that makeover ships.
Microsoft plans to include this signature in the December monthly update to the Malicious Software Removal Tool.

News source: Eweek.com


What's new in 0.4.0

  • Added: Firefox 1.5.0.* compatibility
  • Added: (fr-FR)French localization - Webgraph
  • Added: (pt-PT)Portuguese localization - tiagosilva29
  • Added: (es-ES)Spanish localization - Louis
  • Added: Options window
  • Added: Toolbar button customisation
  • Added: Neowin link on Neowin.net logo context menu
  • Added: Toplist button; but set not to show by default
  • Added: NFiles button; but set not to show by default
  • Added: PowerUser.TV podcast website button
  • Added: PM notification concept design to options
  • Added: Working search for Neowin using Neowin's search function
  • Added: Working search for Neowin using Google
  • Added: Search history for search box
  • Added: RSS Icons for all RSS feeds
  • Added: Customizing Windows Vista and its subforums to the forums menu
  • Added: Neowin Clans & Game Servers to Gamers' Hangout in the forums menu
  • Added: Vista Beta Place to Windows Beta Discussion in the forums menu
  • Added: Longhorn Server Beta Place to Windows Beta Discussion in the forums menu
  • Added: Fantasy Sports to The Sporting Arena in the forums menu
  • Fixed: When selecting which buttons not to show on the toolbar; restarting Firefox will add them again
  • Fixed: Clicking Neowin IRC Chat produces two error dialogs instead of one when the user has no IRC client - tiagosilva29
  • Fixed: When you click any button and the website times out you get two error dialog
  • Fixed: Options menu not showing/greyed out in the Extensions window - Yochanan
  • Fixed: Improved RSS feed selection responsiveness
  • Fixed: Duplicate search terms in search box
  • Fixed: Removed dotted focus borders on checkboxes and buttons
  • Removed: Deprecated code from the toolbar
  • Removed: Double clicking neowin toolbar logo will now open Neowin.net frontpage in a tab
  • Removed: Customizing Windows 98SE/ME/2000 in forums menu (Forum no longer exists)
  • Changed: Extension location on my website so that I can provide the updates better in future
  • Changed: Cleaned up alot of the code and made more organized
  • Changed: All Neowin logos to the version 5 logos
  • Changed: Version number format now compatible with the new Firefox 1.5 standards
  • Changed: Neowin.net Home Page menu item now opens in existing tab instead of opening a new one.

Post a comment · Send to friend Comments · There are 65 additional comments
(10 replies) #1 rIaHc3 on 13 Nov 2005 - 23:23
And the beating by Microsoft continues....
#1.1 kizzaaa on 14 Nov 2005 - 09:28
how is this beating? What Sony has done is unacceptable by any standards.
#1.2 MrCobra on 14 Nov 2005 - 10:21
True, but since it removes the rootkit it could be said that Microsoft is providing a means to allow it's users to circumvent copy protection. It's possible.
#1.3 mrbester on 14 Nov 2005 - 10:49
But extemely unlikely. After all, Sony broke the Windows EULA by compromising the security of the operating system at a root level and altering Microsoft's proprietary software. Microsoft is attempting to ensure that that doesn't happen as a protection of a) its code and b) it users which it is entitled to do regardless of any "nose-out-of-joint"edness this may cause a third party. And a good thiing too. Any software that alters the fundamental operation should be classified as "Malicious Software", which includes any so-called acceptable ownage by a major corp. in the guise of "protecting the artist" (bollocks)
#1.4 kravex on 14 Nov 2005 - 13:01
I'm guessing that Sony have asked Microsoft to do this for them, to try and clean up their mess without to much fuss.
#1.5 rIaHc3 on 14 Nov 2005 - 13:52
I ment profitwise (Thats automatic)
Console wise (EG: MS is delivering while Sony isnt...)

This IMO is more over the console war....MS just wants to get more and more fans for their console.

Sneaky
#1.6 Cailin on 14 Nov 2005 - 20:41
What are you talking about? This has nothing -- absolutely NOTHING -- to do with consoles. Sony BMG and Microsoft Windows division are two separate companies from Sony Computer Entertainment and Microsoft Game Studios.
#1.7 Surr3al on 14 Nov 2005 - 22:54
rIaHc3, I hope you're joking because you are hilarious.
#1.8 matt74441 on 15 Nov 2005 - 00:23
To think this has anything to do with the console wars is a little far-fetched IMO.
#1.9 GALawyer on 15 Nov 2005 - 04:24
I believe that there might be a little criminal/civil issue going on here. Would it not be funny, after all the measures which Sony and the music industry took against individuals for copying and then turned around a placed a malicious code onto unsuspecting legal purchasers of their music, if the tables were turned!!!!!!

Is there any on the forum who is a resident of the state of Georgia. Please reply!
#1.10 astralwerks on 15 Nov 2005 - 19:14
Well for me this does apply to consoles. I have always bought sony products but after this stunt I never will again. So they did lose a loyal customer in me and microsoft just gained one.
#2 shafi on 13 Nov 2005 - 23:27
thats good
#3 twyst3d on 13 Nov 2005 - 23:37
about time microsoft started doing this stuff
#4 BobMarley on 14 Nov 2005 - 00:04
Lol, microsoft have had to clean up macromedia and sony's mess over the weekend.
(2 replies) #5 imtoomuch on 14 Nov 2005 - 00:05
Awesome move by Microsoft. I have to remember to NEVER buy Sony music CDs again. Nobody else should buy them either. Sony is pretty stupid because this move blew up in their face and I'm sure more people will download Sony songs instead of buy the CDs because of this spyware/malware.
#5.1 ipodman715 on 14 Nov 2005 - 00:24
Yeah, they're screwed!
#5.2 Lare2 on 14 Nov 2005 - 12:29
QUOTE
Yeah, they're screwed!


Don't know if they are screwed, but at least a damage to their reputation has been done
#6 Xabora on 14 Nov 2005 - 00:21
Microsoft has earned an Official: "Kudos" from me on this move.
(12 replies) #7 erp on 14 Nov 2005 - 00:40
This is good, but doesn't it violate the DMCA by removing copyright protection? It will be interesting to see how this turns out.
#7.1 markjensen on 14 Nov 2005 - 00:49
And I am thinking that their reasoning, "that the rootkit could be used for malware purposes" is a bit weak. After all, the same could be said about ActiveX.

I think it is good that they are providing a removal tool, though. Don't get me wrong.
#7.2 dhan on 14 Nov 2005 - 01:07
ActiveX is not hidden. Its possible to detect and remove it.
#7.3 Ned on 14 Nov 2005 - 01:59
The copy protection remains on the disk. Removing the software used to run it shouldn't remove the protection.
#7.4 SkyyPunk on 14 Nov 2005 - 03:06
exactly MS is not bypassing security so they can illegally copy the cds or decrypting anything, so it should be fine
#7.5 DrunkenMaster on 14 Nov 2005 - 04:04
Installing a virus on a computer system is likely also against the law in many countries. Sony is in violation of the law IMO.

Unless Sony cleans up its act and stops its Content division (movies, music) from including this crap and colluding with its electronics division with unfair restrictions (see MiniDisc player for one), then I will continue my Sony boycott. That and they're using increasingly cheap components. Sony stuff for me lasts less as long as other products. Makes me wonder why they charge the Sony premium.
#7.6 imtoomuch on 14 Nov 2005 - 04:38
An open-source guy questioning ActiveX...how original!
#7.7 threedaysdwn on 14 Nov 2005 - 06:48
QUOTE
And I am thinking that their reasoning, "that the rootkit could be used for malware purposes" is a bit weak. After all, the same could be said about ActiveX.


Now here's someone who clearly doesn't understand the issue. Let's break down your comparison here:

Sony Rootkit

A secretly installed modification to the kernel environment that attempts to deceive the user by hiding the existance of malicious file and registry objects. It uses invisible proxy device drivers to intercept accesses to your CD drive. Attempting to remove it can render your PC unuseable, or leave your CD drive inaccessible.

ActiveX

A publicly documented API for building componentized applications. It was an evolution of the original OLE 2 technologies that were built on COM. A vast majority of Windows applications are built on ActiveX/COM.



Yeah, I could see how you could confused the two
#7.8 theyarecomingforyou on 14 Nov 2005 - 17:25
QUOTE
An open-source guy questioning ActiveX...how original!


Grow up.
#7.9 markjensen on 14 Nov 2005 - 22:38
QUOTE
An open-source guy questioning ActiveX...how original!

My post clearly questioned the general blanket reason that was offered for the decision to target and remove the Sony DRM software.

Really, "it could be used for malware" applies to just about everything! I made no questioning nor disparaging remarks in regards to ActiveX, Windows, or Microsoft Corporation.

Now, relax a bit...
#7.10 matt74441 on 15 Nov 2005 - 00:28
Lets try and stay civilized guys...
#7.11 threedaysdwn on 15 Nov 2005 - 03:02
QUOTE
My post clearly questioned the general blanket reason that was offered for the decision to target and remove the Sony DRM software.



But you didn't provide any basis for questioning why Microsoft is helping users to remove the rootkit. The original article never said that the reason was "because it could be used for malware purposes." That was added by the Neowin editor who posted the story.

The reason for removing it isn't because it "could be used for malware purposes" - but because it is by its very nature malware.
#7.12 markjensen on 15 Nov 2005 - 12:02
QUOTE
The reason for removing it isn't because it "could be used for malware purposes" - but because it is by its very nature malware.

No. The DRM is being used by OTHER people's processes to hide themselves. It is a tool that is being used/abused.

DRM is not malware.
(2 replies) #8 DJ Specs on 14 Nov 2005 - 01:22
Awww yes! It's times like this that make me proud to have purchased my copy of WinXP.
#8.1 mko on 14 Nov 2005 - 05:05
I'm no hater of Microsoft, in fact I'd say I like them somewhat... but isn't that statement going a bit too far?
#8.2 Jeremy1 on 14 Nov 2005 - 21:14
Believe it or not, many people actually do purchase Windows. If it weren't for people like us, you pirates wouldn't have anything to steal.
#9 el__sid on 14 Nov 2005 - 02:15
Well done Microsoft, but I do hope that Microsoft charge all labour expenses incured by the programmers to Sony.
(1 reply) #10 y0sh on 14 Nov 2005 - 02:51
Protect your OS, Microsoft. Good one!
Too bad I don't buy much music (apart from what I consider 10/10 or if it is rare).. so I'll never get this rootkit crap.
#10.1 xTrinity on 14 Nov 2005 - 07:56
Most likely, whatever you consider 10/10 from now on will be DRM encumbered. Good luck not getting this rootkit crap
#11 timmmay on 14 Nov 2005 - 03:10
i was pleasantly surprised to read this, good work MS! i hope sony learn from this
(2 replies) #12 dolimite35 on 14 Nov 2005 - 03:37
Was the rootkit by "SONY" Sony or just Sony of America? im thinking it was a move by Sony of America
#12.1 Ravensworth on 14 Nov 2005 - 04:18
What's that supposed to mean? Not that it matters but the rootkit itself was developed by a company in England.
#12.2 xTrinity on 14 Nov 2005 - 08:00
Whether it was by Sony or not is irrelevant. The fact that Sony has licensed (which infers knowledge of what this DRM does) the rootkit from First4Internet should be outrageous enough.

For your information, this is a move on the part of Sony BMG, which is under the name of Sony, however remain a seperate branch devoted only to music.
(5 replies) #13 Gibwar on 14 Nov 2005 - 03:39
w00t Microsoft! I was hoping they would remove it. Its about time someone said enough is enough when it comes to DRM... and this is the first small step of many.
#13.1 toadeater on 14 Nov 2005 - 04:29
Being anti-DRM is in MS's interest. MS wants Windows PCs to be the center of home entertainment. If companies like Sony cripple PCs with DRM people will start using other platforms and means. Hardware manufacturers are the same way; DVD burner sales, PC multimedia hardware sales would plummet if you weren't able to record DVDs anymore, or play them at full res on PCs.

Then look at the other side of it. Who makes standalone home theater systems, DVD players, etc? Sony. They don't want their hardware becoming obsolete either. You can bet they won't cripple their own hardware if PCs remain fully-functional.
#13.2 Ravensworth on 14 Nov 2005 - 05:23
Microsoft is not anti-DRM; that's not why they are removing this. It's only because of the dangerous way this particular software works and the serious risks it opens up.
#13.3 threedaysdwn on 14 Nov 2005 - 06:52
As far as I'm aware, Microsoft isn't pro-DRM or anti-DRM. Microsoft is about choice. Choice for the content provider, and choice for the consumer.

I think that any disdain for restrictive licensing should be addressed to the content providers (for example, the RIAA), and not Microsoft. That is except of course for Microsoft's own software licensing. But I'd say that's a seperate issue entirely.
#13.4 xTrinity on 14 Nov 2005 - 08:05
QUOTE
Microsoft is about choice. Choice for the content provider, and choice for the consumer.


Lol, that made me laugh. Thanks.

No, Microsoft is far from being "about choice". That is why they have been sued for anti-trust more than once.

Microsoft is in this for their own self interest. Broken computers, whatever the cause, do not look good for Microsoft. This is especially true if the cause is due to a security hole. The Sony DRM presents a security hole and Microsoft aims to fix it.
#13.5 threedaysdwn on 15 Nov 2005 - 03:14
QUOTE
Lol, that made me laugh. Thanks.

No, Microsoft is far from being "about choice". That is why they have been sued for anti-trust more than once.

Microsoft is in this for their own self interest. Broken computers, whatever the cause, do not look good for Microsoft. This is especially true if the cause is due to a security hole. The Sony DRM presents a security hole and Microsoft aims to fix it.


What does "sued for anti-trust" mean exactly? Yes, 10 years ago Microsoft was found to be a monopoly (not necessarily a bad thing) and was bound by restrictions that prevent Microsoft from directly leveraging that monopoly to manipulate other markets.

But that has nothing to do with Microsoft's position on DRM technology.

You're right about why Microsoft is removing Sony's trash. Because it's good for Microsoft's customers. Because doing things that are good for the customer will only help Microsoft.

However, my comment about Microsoft's position on DRM (that Microsoft supports choice for both content providers and consumers) was in reference to the above 2 commentors who were discussing Microsoft's position on DRM, not the article itself.

And I stand by those comments. Microsoft provides content providers the option of restricting use through DRM. But they don't encourage or discourage them from doing it. Microsoft is also about choice for the consumer. That's why Microsoft's DRM platform can be licensed for use on any device or platform (unlike Apple's FairPlay, for instance).

It's in Microsoft's interest to make their DRM platform as flexible and pro-user as possible (while still appeasing the content providers). It's a difficult balance, since the interests of content providers and users are often not aligned.
(1 reply) #14 Octol on 14 Nov 2005 - 05:31
I've been watching Sony—and the quality of its products—go slowly down the tubes for a long time now. So whenever I've had to replace any Sony items that I've had, I've been replacing them with other brands (mostly Panasonic for home electronics).

Even so, I might normally have been inclined to buy this or that Sony item if, for example, I found something half-way decent on sale. But now that they've shown that they can't be trusted, I wouldn't touch any of their stuff on a bet.

Screw 'em.
#14.1 threedaysdwn on 14 Nov 2005 - 06:58
I think Samsung has replaced Sony as the leader in quality consumer electronics. And they've certainly got plenty of good competition in other areas (PCs, game consoles, cameras, flash memory, etc).

But it's their media divisions (Sony BMG and Sony Pictures) that worry me. They're both part of industry conglomerates that seem to care very little for their consumers, with little or no competition to challenge them or keep them honest.
#15 insanekiwi on 14 Nov 2005 - 08:02
let's hope otherprograms will be able to remove rootkits in future..
#16 Mando on 14 Nov 2005 - 08:53
yaaay good for you microsoft

dam thee Sony
#17 war on 14 Nov 2005 - 08:58
Never thought I'd say.

Microsoft kicks ass!
#18 kravex on 14 Nov 2005 - 09:06
Sony are just using Microsoft for their own PR and I'm surprised Microsoft let them.

They should have said no that way Sony would have to release a removal tool themselves which would be a big embarrassment for them.

This way there almost getting away with it, what’s next a Microsoft hotfix to stop it installing?
(1 reply) #19 Galley on 14 Nov 2005 - 10:10
The next thing that Sony needs to do is to offer free Non-DRM replacement discs of every "CD" that was sold with the rootkit software on it.
#19.1 Lare2 on 14 Nov 2005 - 12:33
I don't own any of those, but that idea is great. Customers should demand it
#20 Jasur on 14 Nov 2005 - 12:18
Good stuff.
(1 reply) #21 Turge2000 on 14 Nov 2005 - 13:20
Now that Microsoft is cleaning up their mess, Sony will have to find an alternative method to punish their customers for attempting to "play" their CDs in computers. Perhaps upgrading their customers' optical drives with corrupt firmware would be the next step? Or since rendering the OS unusable is only a temporary solution (It can be reinstalled in 15 minutes), they might change the firmware of their motherboard and/or video card preventing their computers from even turning on. This way, Microsoft Anti-Spyware will be useless and Microsoft will lose.

Go, Sony, Go!

(I can't wait to see what goodies the PS3 will bring us!)
#21.1 DrIndianaJones on 15 Nov 2005 - 04:25
Go, fanboy, go!
#22 capeche on 14 Nov 2005 - 16:35
This can only be good news. I wish they'd jumped on this earlier, but I'm glad they've done the right thing.
#23 blu3Fusion on 14 Nov 2005 - 16:51
big "boo" to sony and big "woohoo" to MS.
i still can remember how sucky their customer services are.
"i am sorry, becuz u r not using SONY's windows xp professional cd, i can't help u"
"*(&&#(*&$#"
#24 chicken-royal on 14 Nov 2005 - 17:07
wahey, got posted. lol
#25 Andy13 on 14 Nov 2005 - 17:19
Yay, Microsoft is doing the right thing.

I've been impressed with Microsoft lately... they are really improving as a company.

Sony is going down for sure.
(2 replies) #26 Krome on 14 Nov 2005 - 20:47
I bet the guy that suggested Sony to use this method got fired by now.
#26.1 DJ Specs on 14 Nov 2005 - 20:55
Knowing them, he probably got a promotion..
#26.2 zorak on 14 Nov 2005 - 21:45
Hopefully he's still at Sony, heaven forbid he lands somewhere like the MPAA, RIAA or FCC ... /shudder.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)