Solved

How can I get rid of $sys$DRMServer.exe

Posted on 2007-04-09
7
843 Views
Last Modified: 2008-03-17
Can anyone tell me how to get rid of this Sony DRM Root Kit that leaves a service named $sys$DRMServer.exe running.  
0
Comment
Question by:alan_horn
7 Comments
 
LVL 66

Expert Comment

by:johnb6767
ID: 18877827
MG| Free Download - GMER 1.0.12.12086
http://www.majorgeeks.com/GMER_d5198.html

Sophos Anti-Rootkit
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Try these 2....
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 18877846
Malicious Software Removal Tool
http://www.microsoft.com/security/malwareremove/default.mspx

MS's tool is supposed to be updated soon to remove this, but I dont know if it has been released to do this yet....Might check Window Updates....

Netcraft: Microsoft Update Will Remove Sony DRM Rootkits
http://news.netcraft.com/archives/2005/11/13/microsoft_update_will_remove_sony_drm_rootkit.html
0
 
LVL 27

Accepted Solution

by:
Tolomir earned 500 total points
ID: 18878584
0
Are end users causing IT problems again?

You’ve taken the time to design and update all your end user’s email signatures, only to find out they’re messing up the HTML, changing the font and ruining the imagery. What can you do to prevent this? Find out how you can save your signatures from end users today.

 
LVL 47

Expert Comment

by:rpggamergirl
ID: 18879948
I second Tolomir's good advice. Removing Sony rootkit properly is important so as not to screw up your drive.

Grinler has an in-depth tutorial about Sony DRM rootkit:
http://www.bleepingcomputer.com/forums/topic34904.html

If the Sony rootkit service is now showing(also shows in hijackthis log) then the rootkit is no longer active.
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - First 4 Internet Ltd - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe

The rootkit hides all files and services that start with $sys$. So If "$sys$DRMServer.exe" service is showing that means that the rootkit is no longer active and its okay to leave it installed.

Or: you could delete the service:
Start > Run > type in
cmd
press Enter, and run these commands and press Enter after each:
sc stop $sys$DRMServer
sc delete $sys$DRMServer

then make sure to delete the file it's pointing to --> C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
0
 
LVL 27

Expert Comment

by:Tolomir
ID: 18880457
If you are in the U.S. you can even get a DRM free CD from your dealer. Just exchange the DRM protected one.

http://www.theinternetpatrol.com/instructions-for-exchanging-your-sony-bmg-cds-with-rootkit-for-safe-cds
Summary: Instructions for exchanging Sony BMG CDs with XCP for Sony BMG CDs without the Rootkit

This is also interesting: http://sonybmg.com/copy_protection_settlement2.html

Tolomir
0
 
LVL 27

Expert Comment

by:Tolomir
ID: 18885127
Thank you.

Tolomir
0
 

Author Comment

by:alan_horn
ID: 18888860
Exactly what I needed,  Thank You
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Read about achieving the basic levels of HRIS security in the workplace.
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now