Solved

How can I get rid of $sys$DRMServer.exe

Posted on 2007-04-09
7
865 Views
Last Modified: 2008-03-17
Can anyone tell me how to get rid of this Sony DRM Root Kit that leaves a service named $sys$DRMServer.exe running.  
0
Comment
Question by:alan_horn
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 66

Expert Comment

by:johnb6767
ID: 18877827
MG| Free Download - GMER 1.0.12.12086
http://www.majorgeeks.com/GMER_d5198.html

Sophos Anti-Rootkit
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Try these 2....
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 18877846
Malicious Software Removal Tool
http://www.microsoft.com/security/malwareremove/default.mspx

MS's tool is supposed to be updated soon to remove this, but I dont know if it has been released to do this yet....Might check Window Updates....

Netcraft: Microsoft Update Will Remove Sony DRM Rootkits
http://news.netcraft.com/archives/2005/11/13/microsoft_update_will_remove_sony_drm_rootkit.html
0
 
LVL 27

Accepted Solution

by:
Tolomir earned 500 total points
ID: 18878584
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 
LVL 47

Expert Comment

by:rpggamergirl
ID: 18879948
I second Tolomir's good advice. Removing Sony rootkit properly is important so as not to screw up your drive.

Grinler has an in-depth tutorial about Sony DRM rootkit:
http://www.bleepingcomputer.com/forums/topic34904.html

If the Sony rootkit service is now showing(also shows in hijackthis log) then the rootkit is no longer active.
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - First 4 Internet Ltd - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe

The rootkit hides all files and services that start with $sys$. So If "$sys$DRMServer.exe" service is showing that means that the rootkit is no longer active and its okay to leave it installed.

Or: you could delete the service:
Start > Run > type in
cmd
press Enter, and run these commands and press Enter after each:
sc stop $sys$DRMServer
sc delete $sys$DRMServer

then make sure to delete the file it's pointing to --> C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
0
 
LVL 27

Expert Comment

by:Tolomir
ID: 18880457
If you are in the U.S. you can even get a DRM free CD from your dealer. Just exchange the DRM protected one.

http://www.theinternetpatrol.com/instructions-for-exchanging-your-sony-bmg-cds-with-rootkit-for-safe-cds
Summary: Instructions for exchanging Sony BMG CDs with XCP for Sony BMG CDs without the Rootkit

This is also interesting: http://sonybmg.com/copy_protection_settlement2.html

Tolomir
0
 
LVL 27

Expert Comment

by:Tolomir
ID: 18885127
Thank you.

Tolomir
0
 

Author Comment

by:alan_horn
ID: 18888860
Exactly what I needed,  Thank You
0

Featured Post

The Ultimate Checklist to Optimize Your Website

Websites are getting bigger and complicated by the day. Video, images, custom fonts are all great for showcasing your product/service. But the price to pay in terms of reduced page load times and ultimately, decreased sales, can lead to some difficult decisions about what to cut.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are many software programs on offer that will claim to magically speed up your computer. The best advice I can give you is to avoid them like the plague, because they will often cause far more problems than they solve. Try some of these "do it…
Configuring Remote Assistance for use with SCCM
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question