Check this out. Mark Russinovich's Systernals Blog.
"The entire experience was frustrating and irritating. Not only had Sony put software on my system that uses techniques commonly used by malware to mask its presence, the software is poorly written and provides no means for uninstall. Worse, most users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files.
While I believe in the media industry’s right to use copy protection mechanisms to prevent illegal copying, I don’t think that we’ve found the right balance of fair use and copy protection, yet. This is a clear case of Sony taking DRM too far."
Mark is an authority (understatement) on the detection of Rootkits (in essence stealth technology that enables programs to remain hidden from the OS while they perform whatever their function is). Although they can be genuinely useful for administrators trying to protect their system from abusers, they are mostly at the moment associated with Trojans, although they are increasingly being used on a wider basis for more more general malware/adware.
On a protected machine they should be reasonably preventable - so how & why did Mr Russinovich fall victim to one. Simple, he bought a Sony CD from Amazon.Com. and because he trusted the name - he gave the CD permissions he came to regret.
I encourage you to take a look, it is an object lesson in what happens when you haven't felt the need to fully understand what you're saying yes to. Also Mark illustrates his search for the offending files, which is interesting and educational for those interested in computer forensics.
As for Sony - this could and should bite them back hard. After all, if you can get hit on this level by Sony, what price the argument for not sourcing P2P because of the fear of infection. It certainly hasn't helped the music industry.
N.B. Understand that Mark Russinovich is great at what he does, and that not all Rootkits are equal. Prevention is the key, the cure is 99% of the time a total reformat of a system compromised by a malicious rootkit.
