Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 879
  • Last Modified:

How can I get rid of $sys$DRMServer.exe

Can anyone tell me how to get rid of this Sony DRM Root Kit that leaves a service named $sys$DRMServer.exe running.  
0
alan_horn
Asked:
alan_horn
1 Solution
 
johnb6767Commented:
MG| Free Download - GMER 1.0.12.12086
http://www.majorgeeks.com/GMER_d5198.html

Sophos Anti-Rootkit
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Try these 2....
0
 
johnb6767Commented:
Malicious Software Removal Tool
http://www.microsoft.com/security/malwareremove/default.mspx

MS's tool is supposed to be updated soon to remove this, but I dont know if it has been released to do this yet....Might check Window Updates....

Netcraft: Microsoft Update Will Remove Sony DRM Rootkits
http://news.netcraft.com/archives/2005/11/13/microsoft_update_will_remove_sony_drm_rootkit.html
0
 
TolomirAdministratorCommented:
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
rpggamergirlCommented:
I second Tolomir's good advice. Removing Sony rootkit properly is important so as not to screw up your drive.

Grinler has an in-depth tutorial about Sony DRM rootkit:
http://www.bleepingcomputer.com/forums/topic34904.html

If the Sony rootkit service is now showing(also shows in hijackthis log) then the rootkit is no longer active.
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - First 4 Internet Ltd - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe

The rootkit hides all files and services that start with $sys$. So If "$sys$DRMServer.exe" service is showing that means that the rootkit is no longer active and its okay to leave it installed.

Or: you could delete the service:
Start > Run > type in
cmd
press Enter, and run these commands and press Enter after each:
sc stop $sys$DRMServer
sc delete $sys$DRMServer

then make sure to delete the file it's pointing to --> C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
0
 
TolomirAdministratorCommented:
If you are in the U.S. you can even get a DRM free CD from your dealer. Just exchange the DRM protected one.

http://www.theinternetpatrol.com/instructions-for-exchanging-your-sony-bmg-cds-with-rootkit-for-safe-cds
Summary: Instructions for exchanging Sony BMG CDs with XCP for Sony BMG CDs without the Rootkit

This is also interesting: http://sonybmg.com/copy_protection_settlement2.html

Tolomir
0
 
TolomirAdministratorCommented:
Thank you.

Tolomir
0
 
alan_hornAuthor Commented:
Exactly what I needed,  Thank You
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now