[URL] Symantec: XCP removal tool

  • Thread starter Thread starter Vrodok the Troll
  • Start date Start date
V

Vrodok the Troll

http://www.boycottsony.us/

- - - - - - -
November 11th, 2005

Sony BMG’s decision to pull their DRM from the market -- temporarily -- doesn’t
help those folks who already loaded the rootkit on their PCs. If you’re already
infected by the Sony BMG/First4Internet rootkit, try this
<http://tinyurl.com/an74d> removal tool from Symantec.
- - - - - - -
 
Vrodok said:
http://www.boycottsony.us/

- - - - - - -
November 11th, 2005

Sony BMG’s decision to pull their DRM from the market -- temporarily -- doesn’t
help those folks who already loaded the rootkit on their PCs. If you’re already
infected by the Sony BMG/First4Internet rootkit, try this
<http://tinyurl.com/an74d> removal tool from Symantec.
- - - - - - -
Click to expand...

Thanks for posting that Vrodok. I'll be downloading that for
disinfecting other computers.

I wonder if one could detect that Sony rootkit infection by using the
technique described on Mark Russinovich's page at
http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html:

"Armed with the knowledge of what driver implemented the cloaking I set
off to see if I could disable the cloak and expose the hidden processes,
files, directories, and Registry data. Although RKR indicated that the
\Windows\System32\$sys$filesystem directory was hidden from the Windows
API, it’s common for rootkits to hide directories from a directory
listing, but not to prevent a hidden directory from being opened
directly. I therefore checked to see if I could examine the files within
the hidden directory by opening a command prompt and changing into the
hidden directory. Sure enough, I was able to enter and access most of
the hidden files:"

(and here Mark has a picture of a DOS window with a DIR command response
within c:\windows\system32\$sys$filesystem)

I did this on my system, but I know that I'm free from that infection so
there's no way of telling if this will work with Millennium Edition.

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.
 
Vrodok said:
http://www.boycottsony.us/

- - - - - - -
November 11th, 2005

Sony BMG’s decision to pull their DRM from the market -- temporarily -- doesn’t
help those folks who already loaded the rootkit on their PCs. If you’re already
infected by the Sony BMG/First4Internet rootkit, try this
<http://tinyurl.com/an74d> removal tool from Symantec.
- - - - - - -
Click to expand...

I swear though, this Sony fiasco is like wiping your butt on a hula
hoop. There's no end to the cr**.

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.
 
John Corliss said:
Thanks for posting that Vrodok. I'll be downloading that for
disinfecting other computers.

I wonder if one could detect that Sony rootkit infection by using the
technique described on Mark Russinovich's page at
http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html:

"Armed with the knowledge of what driver implemented the cloaking I set
off to see if I could disable the cloak and expose the hidden processes,
files, directories, and Registry data. Although RKR indicated that the
\Windows\System32\$sys$filesystem directory was hidden from the Windows
API, it’s common for rootkits to hide directories from a directory
listing, but not to prevent a hidden directory from being opened
directly. I therefore checked to see if I could examine the files within
the hidden directory by opening a command prompt and changing into the
hidden directory. Sure enough, I was able to enter and access most of
the hidden files:"

(and here Mark has a picture of a DOS window with a DIR command response
within c:\windows\system32\$sys$filesystem)

I did this on my system, but I know that I'm free from that infection so
there's no way of telling if this will work with Millennium Edition.

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.
Click to expand...

It should work with no problems on any Windows system that can open a
command prompt. And, for all you WinXP users out there.... you aren't
completely out of luck. If you put an old Win98 or WinME install disk into
your CD Drive you can start the computer from the DOS on the CD even though
your computer doesn't contain DOS 7 itself. That means that in an emergency,
you can still get to a DOS session - something that has saved a number of
people grief so far. Just another toolkit for your armoury....

Mike Bourke
 
Mike Bourke said:
It should work with no problems on any Windows system that can open a
command prompt. And, for all you WinXP users out there.... you aren't
completely out of luck. If you put an old Win98 or WinME install disk into
your CD Drive you can start the computer from the DOS on the CD even
though
your computer doesn't contain DOS 7 itself. That means that in an
emergency,
you can still get to a DOS session - something that has saved a number of
people grief so far. Just another toolkit for your armoury....

Mike Bourke
Click to expand...
As long as you don't have NTFS, that is.
 
Thip said:
As long as you don't have NTFS, that is.
Click to expand...

Correct me if I'm wrong, but isn't that the default FS for XP Pro?

--
Regards from John Corliss
My current killfile: aafuss, Chrissy Cruiser, Slowhand Hussein, BEN
RITCHEY and others.
No adware, cdware, commercial software, crippleware, demoware, nagware,
PROmotionware, shareware, spyware, time-limited software, trialware,
viruses or warez please.
 
John Corliss said:
Correct me if I'm wrong, but isn't that the default FS for XP Pro?
Click to expand...
You have the choice when you set up XP. Fat32 or NTFS.
I personally still use Fat32 for compat reasons..
bw..OJ
 
I swear though, this Sony fiasco is like wiping your butt on a hula
hoop. There's no end to the cr**.
Click to expand...

Let us hope $ony comes to their corporate senses before .... TSHTF
(figuratively, for them).
 
Back
Top