Sony DRM Rootkit - collected Wilders-threads

Discussion in 'malware problems & news' started by FanJ, Nov 13, 2005.

Thread Status:
Not open for further replies.
Page 1 of 2
  1. FanJ

    FanJ Guest

    I thought that it might be a good idea to give a list of all the threads here at the Wilders-board about the Sony DRM Rootkit.
    Name and link of the thread is given.

    To the Mods: I wasn't sure where to post this.
    To all: please feel free to add threads that I forgot to add.

    Mark's Sysinternals Blog: Sony, Rootkits and Digital Rights Management...
    https://www.wilderssecurity.com/showthread.php?t=104457

    First Trojan using Sony DRM spotted
    https://www.wilderssecurity.com/showthread.php?t=105944

    SONY.....Need info on the "Legal" rootkit
    https://www.wilderssecurity.com/showthread.php?t=104827

    can ProcessGuard protect form sony rootkit? is there secreenshot?
    https://www.wilderssecurity.com/showthread.php?t=105890

    Will NOD32 protect against First-4 (Sony/BMG) Rootkit
    https://www.wilderssecurity.com/showthread.php?t=105097
    (thread is closed)

    Is NOD32 going to detect and stop this type of thing?
    https://www.wilderssecurity.com/showthread.php?t=104672

    SONY throws in the towel ... for now.
    https://www.wilderssecurity.com/showthread.php?t=106216&

    Panda: TruPrevent, Trojans, and Sony's anti-piracy system
    https://www.wilderssecurity.com/showthread.php?t=106170

    Norman SandBox with early detection of security risk created by DRM protected Sony
    https://www.wilderssecurity.com/showthread.php?t=105974

    MS Anti Spyware to wipe Sony Rootkit
    https://www.wilderssecurity.com/showthread.php?t=106421

    Will anti-rookit programs detect Sony rootkit?
    https://www.wilderssecurity.com/showthread.php?t=105494

    PestPatrol will detect and remove Sony's rootkit-enabled DRM software
    https://www.wilderssecurity.com/showthread.php?t=106454

    Is there any potential risks in Sony's BMG:s?
    https://www.wilderssecurity.com/showthread.php?t=105007
     
    FanJ, Nov 13, 2005
    #1
  2. Stephanos G.

    Stephanos G. Registered Member

    Joined:
    Mar 29, 2005
    Posts:
    720
    Location:
    Cyprus
    Thanks
     
    Stephanos G., Nov 14, 2005
    #2
  3. FanJ

    FanJ Guest

    FanJ, Nov 14, 2005
    #3
  4. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    163,926
    Location:
    Texas
    ronjor, Nov 14, 2005
    #4
  5. controler

    controler Guest

    I always thought the service should be stopped before deleting?

    net stop $sys$aries

    NO?

    controler
     
    controler, Nov 15, 2005
    #5
  6. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Still learning them but are not most rootkits drivers and is not aries.sys a driver ?
     
    Bubba, Nov 15, 2005
    #6
  7. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Bubba, Nov 15, 2005
    #7
  8. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    163,926
    Location:
    Texas
    Sony's 'Rootkit' Is on 500,000 Systems
    .

    Story
     
    ronjor, Nov 15, 2005
    #8
  9. J at A

    J at A Guest

    J at A, Nov 15, 2005
    #9
  10. FanJ

    FanJ Guest

    Last edited by a moderator: Nov 17, 2005
    FanJ, Nov 16, 2005
    #10
  11. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Mark's Sysinternals Blog....Wednesday, November 16, 2005


     
    Bubba, Nov 16, 2005
    #11
  12. blackimp

    blackimp Registered Member

    Joined:
    Feb 27, 2004
    Posts:
    5
    blackimp, Nov 17, 2005
    #12
  13. FanJ

    FanJ Guest

    FanJ, Nov 17, 2005
    #13
  14. controler

    controler Guest

    Bubba and VXD's are drivers too LOL


    bought a new Neil Diamond CD today with the rootkit on it at Best Buy;)
     
    controler, Nov 17, 2005
    #14
  15. FanJ

    FanJ Guest

    FanJ, Nov 18, 2005
    #15
  16. controler

    controler Guest

    UnHackMe Pro

    Labled as Hacker Defender

    1. Scan for viruses:

    C:\WINDOWS\CDProxeyServ.exe

    c:\WINDOWS\system\$sys$filesystem\$sys$DRMServer

    C:\WINDOWS\SYSTEM32\DRIVERS\$sys$COR.SYS

    2. Checkme Now;

    $sys$aires

    $sys$cor

    $sys$crater

    $sys$DRMServer

    $sys$lim

    $sys$oct

    Regrun reanimator shows the same VXD Driver with the $sys$ prefix.

    & WIndows Core
     

    Attached Files:

    controler, Nov 20, 2005
    #16
  17. Yuppers

    Yuppers Guest

    Yuppers, Nov 20, 2005
    #17
  18. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    163,926
    Location:
    Texas
    ronjor, Nov 21, 2005
    #18
  19. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    163,926
    Location:
    Texas
    ronjor, Nov 22, 2005
    #19
  20. Wayne - DiamondCS

    Wayne - DiamondCS Security Expert

    Joined:
    Jul 19, 2002
    Posts:
    1,533
    Location:
    Perth, Oz
    Wayne - DiamondCS, Nov 22, 2005
    #20
  21. Triple Helix

    Triple Helix Specialist

    Joined:
    Nov 20, 2004
    Posts:
    13,275
    Location:
    Ontario, Canada
    Triple Helix, Nov 22, 2005
    #21
  22. TNT

    TNT Registered Member

    Joined:
    Sep 4, 2005
    Posts:
    948
    TNT, Nov 22, 2005
    #22
  23. eyes-open

    eyes-open Registered Member

    Joined:
    May 13, 2005
    Posts:
    721
    eyes-open, Nov 24, 2005
    #23
  24. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    163,926
    Location:
    Texas
    New Sony CD security risk found
    Story
     
    ronjor, Dec 6, 2005
    #24
  25. beetlejuice69

    beetlejuice69 Registered Member

    Joined:
    Mar 16, 2005
    Posts:
    780
    beetlejuice69, Dec 7, 2005
    #25
Page 1 of 2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...