quote:

The version of this software used in Sony CDs is the one marketed as "XCP-Aurora". The first time a user attempts to play such a CD on a Windows system, a program will be installed even before a dialog box prompts the user to accept a license agreement.[3] The EULA did not mention that it installed hidden software. The software will then remain resident in the user's system, intercepting all accesses of the CD drive to prevent any media player or ripper software other than the one included with XCP-Aurora from accessing the music tracks of the Sony CD. No obvious way to uninstall the program is provided. Attempting to remove the software by deleting the associated files manually will render the CD drive inoperable due to registry settings that the program has altered.

....

XCP's cloaking technique, which makes all processes with names starting with $sys$ invisible, can be used by other malware "piggybacking" on it to ensure that it, too, is hidden from the user's view. The first malicious trojan to use this technique was discovered on 10 November 2005 according to a report by the BitDefender antivirus company.[4]

....

On a National Public Radio program, Thomas Hesse, President of Sony BMG's global digital business division asked "Most people, I think, don't even know what a rootkit is, so why should they care about it?"[12] He explained that "The software is designed to protect our CDs from unauthorized copying and ripping and Rootkit technology is one of the best ways to do just that."

**********