Solved

How can I get rid of $sys$DRMServer.exe

Posted on 2007-04-09
7
859 Views
Last Modified: 2008-03-17
Can anyone tell me how to get rid of this Sony DRM Root Kit that leaves a service named $sys$DRMServer.exe running.  
0
Comment
Question by:alan_horn
7 Comments
 
LVL 66

Expert Comment

by:johnb6767
ID: 18877827
MG| Free Download - GMER 1.0.12.12086
http://www.majorgeeks.com/GMER_d5198.html

Sophos Anti-Rootkit
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Try these 2....
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 18877846
Malicious Software Removal Tool
http://www.microsoft.com/security/malwareremove/default.mspx

MS's tool is supposed to be updated soon to remove this, but I dont know if it has been released to do this yet....Might check Window Updates....

Netcraft: Microsoft Update Will Remove Sony DRM Rootkits
http://news.netcraft.com/archives/2005/11/13/microsoft_update_will_remove_sony_drm_rootkit.html
0
 
LVL 27

Accepted Solution

by:
Tolomir earned 500 total points
ID: 18878584
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 47

Expert Comment

by:rpggamergirl
ID: 18879948
I second Tolomir's good advice. Removing Sony rootkit properly is important so as not to screw up your drive.

Grinler has an in-depth tutorial about Sony DRM rootkit:
http://www.bleepingcomputer.com/forums/topic34904.html

If the Sony rootkit service is now showing(also shows in hijackthis log) then the rootkit is no longer active.
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - First 4 Internet Ltd - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe

The rootkit hides all files and services that start with $sys$. So If "$sys$DRMServer.exe" service is showing that means that the rootkit is no longer active and its okay to leave it installed.

Or: you could delete the service:
Start > Run > type in
cmd
press Enter, and run these commands and press Enter after each:
sc stop $sys$DRMServer
sc delete $sys$DRMServer

then make sure to delete the file it's pointing to --> C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
0
 
LVL 27

Expert Comment

by:Tolomir
ID: 18880457
If you are in the U.S. you can even get a DRM free CD from your dealer. Just exchange the DRM protected one.

http://www.theinternetpatrol.com/instructions-for-exchanging-your-sony-bmg-cds-with-rootkit-for-safe-cds
Summary: Instructions for exchanging Sony BMG CDs with XCP for Sony BMG CDs without the Rootkit

This is also interesting: http://sonybmg.com/copy_protection_settlement2.html

Tolomir
0
 
LVL 27

Expert Comment

by:Tolomir
ID: 18885127
Thank you.

Tolomir
0
 

Author Comment

by:alan_horn
ID: 18888860
Exactly what I needed,  Thank You
0

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I will show you HOW TO: Install VMware Tools for Windows on a VMware Windows virtual machine on a VMware vSphere Hypervisor 6.5 (ESXi 6.5) Host Server, using the VMware Host Client. The virtual machine has Windows Server 2016 instal…
I've been an avid user and supporter of Malwarebytes Premium Version 2.x for years. It's an excellent product that runs alongside just about any Anti-Virus application without issues. It seems to have an uncanny ability to pick up many things that A…
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

791 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question