Sysinternals' Mark Russinovich has performed an analysis of the copy restriction measures deployed by Sony Music on its latest CDs: which he bluntly calls a 'root kit'. Using conventional tools to remove Sony's digital media malware will leave ordinary users with Windows systems unable to play CDs.
While the Sony CDs play fine on Red Book audio devices such as standard consumer electronics CD players, when they're played on a Windows PC the software forces playback through a bundled media player, and restricts how many digital copies can be made from Windows.
A 'root kit' generally refers to the nefarious malware used by hackers to gain control of a system. A root kit has several characteristics: it finds its way onto systems uninvited; endeavors to remain undetected; and then may either intercept system library routines and reroute them to its own routines, or replace system executables with its own, or both - all with the intention of gaining system level ownership of the computer.
What makes Sony's CD digital media software particularly nasty is that using expert tools for removing the parasite risks leaving you with a Windows PC that's useless, and that requires a full reformat and reinstall.
So is Sony bundling a root kit, or is it the latest in a long line of clumsy, and sometimes laughably inept attempts to thwart the playback of digital media on PCs?
We were inclined to the latter - but in practical terms, for ordinary users, the consequences are so serious that semantic distinctions are secondary.
In actuality both, reckons Russinovich. It's a 'root kit' that arrived uninvited, but it's also "underhanded and sloppy software" , that once removed, prevented Windows from playing his CD again (Van Zant's 'Get With The Man') he notes in his analysis.
The Sony CD creates a hidden directory and installs several of its own device drivers, and then reroutes Windows systems calls to its own routines. It intercepts kernel-level APIs, but then attempts to disguise its presence, using a crude cloaking technique.
Disingenuously, the copy restriction binaries were labelled "Essential System Tools".
But the most disturbing part of the tale came when Russinovich ran his standard rootkit-removal tool on the post-Sony PC.
"Users that stumble across the cloaked files with a RKR scan will cripple their computer if they attempt the obvious step of deleting the cloaked files," he writes.
Which puts it in an entirely different class of software to the copy restriction measures we've seen so far, which can be disabled by a Post-It note. Until specialist tools arrive to disinfect PCs of this particular measure. ®
Mark Russinovich, of SysInternals.com, has discovered a so-called "" which is installed by Sony's new -protected music compact disks (CDs).  A rootkit is a common name for malicious software that is used by computer criminals to hide their presence on a compromised computer.  Rootkits frequently contain hidden files and are designed to be difficult for the user to detect and remove.

Russinovich classifies Sony's rootkit as  because it is alleged to introduce several serious security holes, one of which can be exploited to hide files and prevent the user from removing them.  In particular, all executable files which begin with '$sys$' are hidden when the software is installed.  He points out that these security holes could be exploited by hackers, or other malware producers besides Sony.

Russinovich explains that naively removing the files will result in a crippling of the operating system on the user's computer.  He provides an explanation of the difficult step required to remove Sony's malware.

Playing the same CDs on computers not running the Windows operating system, or on a non-computer based CD player remains safe.  As removing Sony's malware would violate the Digital Millennium Copyright Act's anti-circumvention provisions,  the CDs on computers running a non-Windows operating system may be the best legal and technically safe option for those who wish to listen to them under Windows.

The software is automatically installed when a Sony CD is played on a computer, and is not mentioned in their .  The rootkit has been commercially developed by  First 4 Internet and licensed to Sony.

Other rights management techniques used by music publishers recently include breaking the  compact disc standard format. This technique causes many CD players to not be able to play the new CDs, but also protects against casual ripping.  's recent album release in the United States uses such technology.