bodyType

customContents

entityId

entityUuid

articlePageQuery

filter

article

articleBaseAdvertisingInfoArticle

articleListArticle

articleSeoArticle

hooksArticleAcknowledgementGateOverlayArticle

hooksTrackPageViewArticle

hooksContentInterestArticle

articleLinkingDataContent

hooksAmpRedirectArticle

articleSchemaContent

liveArticle

advertZone

sentiment

contentLock

topics

types

sections

paywallTypes

createdDate

publishedDate

urlAlias

moreOnThisArticles

sponsorType

commentCount

authorLocations

authors

corrections

displaySlideShow

multimediaEmbed

printHeadline

seriesContainer

articleSpeeches

socialHeadline

headline

images

flag

firstTopic

glossary

flattenTypeIds

image

relatedLinks

relatedNewsletters

__typename

sponsor

pdfFiles

seriesReverseOrder

series

disableOffPlatformContent

published

updatedDate

summary

subHeadline

body

keywords

readingTime

customTimezone

liveContents

I have been reading about Sony Music's 'Trojan Horse' music player software that automatically installs itself in a PC whenever loaded with a Sony BMG Music CD. I understand this software cannot be uninstalled, nor   located once installed.

I am incensed and outraged that Sony is doing this. I do buy legitimate music CDs, but I do not actually pay attention to which recording company releases them, so how do I know if I have this malware in my system, especially if it is claimed that 'you can't find it'? Will my antivirus software detect it? Are any other recording companies doing this too?

Harry Chen

Kowloon

This is one of the juiciest items to have come out in years. Not only is it technically interesting, it may stir up a terrific legal storm as well.

This is likely to be with us for quite some time. You may want to watch this space for a while.

Just to recap for those who may not understand the issues: Sony BMG installed 'a bunch of malware' (to quote one source) on users' computers when they wanted to listen to a recent CD they had bought. The technology used is XCP (extended copy protection) and another piece of software known as a rootkit, which came from First 4 DRM.

What the rootkit does is hide any file that begins with the name $sys$. If the software is loaded and you rename any file so that it starts with $sys$, that file will immediately disappear.

Clever, but very dangerous in the wrong hands. Rather obvious, I would have thought, but there you are.

Putting such hacker code on a customer's computer is considered by many to be rather naughty. In some places, notably California, it is in fact illegal. After the press got hold of the story and lots of complaints were lodged, Sony issued a fix. The damage, however, had already been done.

But now that America's national sport has shifted from baseball to litigation, it is almost certain there will be a major lawsuit  soon.

That will be lots of fun to follow.

At the same time, however, it turns out that killing the Sony software could equally be illegal (although it would be difficult to imagine Sony taking anybody to court at this time). Let the lawyers do what they do while we return to technology.

Yes, you could find the code yourself and delete it, but I would strongly suggest you do not do that. Instead, wait for Microsoft or Symantec or somebody else to do it for you.

I never recommend to anyone that they should fool about with low-level code. If you really know what you are doing, you could make an image of the disk and then start playing with the system. If something went horribly wrong, you could just restore it. Still, not really a good idea.

Let the big boys deal with it.

Symantec has a useful description of the problem and point to a fix: http://securityresponse.symantec.com/avcenter/venc/data/securityrisk.ar…



Removal of Sony's Trojan Horse best left to the experts