Hi everyone, I haven’t posted much on this board, but I’ve been an active lurker for the past few years. As such, I still vividly remember the v-mate wars and the whole turmoil about copy-protection.
Recently, I’ve come across an article about a copy-protection scheme that lets v-mate look harmless in comparison and is implemented by no other than Sony…for music CDs. I thought I shared (It’s from the 31st oct 2005):
(Beware, it’s very technical)
http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html
Summarized: A developper of tools for sysadmins finds a rootkit on his PC. That’s a program which hides files, directories or registry keys from the system and is usually used by spyware to cloak its presence. Further investigation showed that the rootkit was installed by copy-protection software from a music CD published by Sony. The program was installed without the knowledge of the user and it took some rather adventurous means to remove it without crippling the system. So, for the average computer user it is undetectable and unremoveable.
What makes the whole situation worse, is that the code is poorly written and consumes processor time even after the CD is removed, it even caused several crashes, at least one of them was unrecoverable. Even if it were better written, rootkits always increase the risk of conflicts and therefore of crashes, as well as creating possible weaknesses which could be exploited for attacks on an infected system.
If your computer (Windows only) ever crashed and reported an error in connection with a file called aries.sys then your system is infected. If that’s the case Read the cited article carefully and/or contact the guys at sysinternals.
By the way read the comments to the article, some of them provide further interesting information.
[This message has been edited by Akela (edited 11-05-2005).]