Removing Sony's Rootkit Rubbish

I am one of those unfortunate people who have had to deal with the removal of Sony's rootkit software from a machine not connected to the internet. For details on what this is all about, read Mark's Blog for technical details, or download the Security Now! podcasts (Episode 12) for the full run down on what this means. If it wasn't for Mark's technical knowledge there is no way I could have done this. I had no idea that the cmd.exe facility was so powerful..

Firstly, you need to do the following:
delete the rootkit’s registration from Windows so that it won’t activate when Windows boots:

Open the Run dialog from the Start menu
Enter "cmd /k sc delete $sys$aries"
Click "OK"

Now you must restart your PC.

Start
Select "Turn off Computer"
Click "Restart"

Once restarted, click on

Start
Select "Search"
Select "For Files or Folders"

(or you could click on the desktop and press F3)
Type in "$sys$*.*"
and do a complete search, as shown here

Delete all the files beginning with $sys$ as well as the folder $sys$system.

Power users can just go to the command prompt and type:
cd \ [enter]
del $sys$*.* /s [enter]

After all this, I would strongly advise using a registry integrity checker like Registry First Aid to check your system for any other nasties that may have been left behind.

-:| [home] | [free stuff] | [blog] |:-

Disable the Data Session

"What makes the Sony BMG incident even more unfortunate is that the DRM technology can be defeated easily. Gartner has identified one simple technique: The user simply applies a fingernail-sized piece of opaque tape to the outer edge of the disc, rendering session 2 — which contains the self-loading DRM software — unreadable. The PC then treats the CD as an ordinary single-session music CD, and the commonly used CD "rip" programs continue to work as usual. (Note: Gartner does not recommend or endorse this technique.) Moreover, even without the tape, common CD-copying programs readily duplicate the copy-protected disc in its entirety." - quote from Sony BMG DRM a Public-Relations and Technology Failure Martin Reynolds and Mike McGuire

Advertisement

Advertisement

In case the lawyers at the beleaguered First4Internet or Sony BMG are wondering about all this, may I point out that I wrote to Sony's Content Protection Help and requested removal instructions, which they refused, or didn't have. The best they could do was refer me to their FAQ page and then add in the following "tip":

If you choose to uninstall the XCP software, you will loose [sic] access to playback the CD on your computer.

Not only are they incompetent, they can't spell! The full correspondence shown below:

-----Original Message-----
From: contentprotectionhelp [mailto:ContentProtectionHelp@info.sel.sony.com] 
Sent: 16 November 2005 10:09 pm
To: Donn Edwards
Subject: RE: ContentProtectionHelp Email Form

Thank you for contacting Sony Online Support.

If you wish to completely uninstall the XCP software, please bookmark the link
below. Sony BMG is in the final stages of developing a non-ActiveX uninstall 
process to address these requests.

   http://cp.sonybmg.com/xcp/english/uninstall.html

TIP: If you choose to uninstall the XCP software, you will
        loose access to playback the CD on your computer.

Thank You,

Your Sony Email Response Team
CC2S
Mike

Original Message Follows:
------------------------
Dear John

How do I uninstall this stuff? It has made the PC unstable, with random BSOD 
screens on startup.

May I point out the EULA implies that the software can be uninstalled. This 
is clearly not true. Now that the EULA has misled me, how do you propose to 
remedy the situation?

Donn

-----Original Message-----
From: contentprotectionhelp [mailto:ContentProtectionHelp@info.sel.sony.com]

Sent: 14 November 2005 07:47 pm
To: Donn Edwards
Subject: RE: ContentProtectionHelp Email Form

Thank you for contacting Sony BMG Online.

I apologize that you have an issue with our uninstall request form. Our online 
uninstall requires that an Internet Explorer ActiveX uninstall tool be 
installed and pop-up windows be temporarily enabled. At this time this online 
process is the only removal tool currently available.

TIP: Should Sony BMG decide to release a non-ActiveX Internet
        uninstall process, it would be posted on our FAQ site at:
        http://cp.sonybmg.com/xcp/english/faq.html#uninstall

Thank you for the opportunity to be of assistance.

The Sony BMG Online Support Team
CC2X
John

Original Message Follows:
------------------------
How do I obtain an uninstall CD? The rootkit you installed is on a PC not 
connected to the internet, and it has no modem or LAN card.

-----Original Message-----
From: contentprotectionhelp [mailto:ContentProtectionHelp@info.sel.sony.com]

Sent: 12 November 2005 09:35 pm
To: 
Subject: Re: ContentProtectionHelp Email Form (KMM15590559I21924L0KM)

Thank you for contacting Sony BMG Online.

Sony BMG and First 4 Internet have released a Service Pack 2 update that 
addresses recent concerns surrounding the cloaking technology component on 
SONY BMG content protected CDs which use XCP technology.  These components 
are not malicious nor spyware however to alleviate any concerns that users 
may have about the program posing potential security vulnerabilities the 
update removes the cloaking component from their computers.  Please visit 
the link below to install the SP2 upgrade.

   http://updates.xcp-aurora.com

If you do not want to install the SP2 update and only wish to uninstall 
the DRM software, visit the form below using IE 5.0 (or higher) from the 
computer where the software is installed. After submission, you will be 
emailed a customized uninstall link within 1 business day (M-F).

   http://cp.sonybmg.com/xcp/english/form9.html
   Your "Case ID" is: 3388114.

TIP: The uninstall request form will require an ActiveX plug-in.
        Also you may need to temporarily turn off any pop-up blocker
        software on the PC.

Thank you for the opportunity to be of assistance.

The Sony BMG Online Support Team
CCKM

Original Message Follows:
------------------------
Email Address: 

Case ID      : 
Packet       : 

Artist Name  : Neil Diamond
Disk Title   : 12 Songs
Store Name   : 
Country      : Other
Language     : 

Problem Type : GENERAL FEEDBACK
Device Type  : 

Manufacturer : 
PC Brand     : 
Model        : 
OS           : 

Auto Mfg     : 
Auto Model   : 
Auto Year    : 

Message      : Uninstall Request

-:| [home] | [free stuff] | [blog] |:-