Microsoft Tool Cleans Sony BMG Mess

The December release of Microsoft's Malicious Software Removal Tool attempts to clean up the mess left behind by Sony BMG's XCP copy protection software, which entered the spotlight in November after the discovery that it installs a rootkit.

Microsoft previously labeled XCP as malware within Windows AntiSpyware, but the MSRT should reach more customers as it's delivered through Windows Update. The tool removes the cloaking and a potentially dangerous ActiveX control, but not Sony's DRM.

"Once again Microsoft has done right by providing a tool for removing the Sony rootkit, but wrong by not removing the entire Sony software package," Jupiter Research senior analyst Joe Wilcox commented to BetaNews.

"Considering the number of security holes associated with this software, Microsoft would do better for its customers by removing all the Sony rootkit DRM software."

Sony has come under intense fire for the XCP DRM utilized on 52 CDs and also SunnComm MediaMax DRM that shipped on another 27 albums. Both copy-protection packages have been found insecure in a number of different ways, and a recent patch to close a security hole in MediaMax also contained a vulnerability.

Although Sony recalled all CDs containing XCP, they can still be found on store shelves, prompting lawsuits from Texas Attorney General Greg Abbott and the Electronic Frontier Foundation.

But is simply replacing discs and fixing the security holes enough? Wilcox doesn't think so, and fellow Jupiter Research analyst Ian Fogg questioned what problems use of such DRM may bring in the future.

"The useful life of a CD is much longer than the Windows XP operating system that this DRM software tightly binds itself into," noted Fogg. "This DRM software must avoid crashing future versions of Windows, which is impossible to guarantee for such unfinished operating systems (especially as it has failed to deliver sufficient reliability for the known quantity that is the current version of Windows)."

Microsoft has remained mum on the larger issue of DRM affecting Windows, but says it will continue to protect its customers as necessary. For now, Microsoft recommends that users "do not install software from CDs that are known to include the rootkit."