Sony Stinx Virus

The computer-virus front has another battleground. According to several news sources, the folks at Sophos, a noted British security software firm, have discovered the first virus to use a hole in the controversial CD copy-protection software from music publisher Sony BMG to enter personal computers and do its damage.

Under a subject line with the words "Photo approval," a hacker has mass-mailed the Stinx E trojan ( svcmfte32.exe )virus to e-mail addresses all over Britain. If a recipient clicks on the attached file they install malware which can destroy firewalls and open access to hackers. The malware uses existing Sony BMG software that installs on any computer playing one of its copy-protected CDs to do its dirty work.

Security software firm Symantec Corp. also discovered these first trojans to abuse this Sony BMG flaw. The music publishing unit of the Japanese electronics conglomerate has distributed the copy-protection software on a range of recent music compact discs from artists such as Celine Dion and Sarah McLachlan. When the CD is played on a Windows personal computer, the software first installs itself and then limits the usage rights of a consumer. It only allows playback with Sony software.

Stung by continuing criticism, the world's second-largest music label, Sony BMG Music Entertainment, promised Friday to temporarily suspend making music CDs with antipiracy technology that can leave computers vulnerable to hackers.

Sony defended its right to prevent customers from illegally copying music but said it will halt manufacturing CDs with the "XCP" technology as a precautionary measure. "We also intend to re-examine all aspects of our content protection initiative to be sure that it continues to meet our goals of security and ease of consumer use," the company said in a statement.

The antipiracy technology, which works only on Windows computers, prevents customers from making more than a few copies of the CD and prevents them from loading the CD's songs onto Apple Computer's popular iPod portable music players. Some other music players, which recognize Microsoft's proprietary music format, would work.

Sony's announcement came one day after leading security companies disclosed that hackers were distributing malicious programs over the Internet that exploited the antipiracy technology's ability to avoid detection. Hackers discovered they can effectively render their programs invisible by using names for computer files similar to ones cloaked by the Sony technology.

Sony's program is included on about 20 popular music titles, including releases by Van Zant and The Bad Plus.

"This is a step they should have taken immediately," said Mark Russinovich, chief software architect at Winternals Software who discovered the hidden copy-protection technology Oct. 31 and posted his findings on his Web log. He said Sony did not admit any wrongdoing, nor did it promise not to use similar techniques in the future.

Security researchers have described Sony's technology as "spyware," saying it is difficult to remove, transmits without warning details about what music is playing, and that Sony's notice to consumers about the technology was inadequate. Sony executives have rejected the description of their technology as spyware.

Some leading antivirus companies updated their protective software this week to detect Sony's antipiracy program, disable it and prevent it from reinstalling.

After Russinovich criticized Sony, it made available a software patch that removed the technology's ability to avoid detection. It also made more broadly available its instructions on how to remove the software permanently. Customers who remove the software are unable to listen to the music CD on their computer.

IRC Stinx Trojan svcmfte32.exe

This trojan copies itself to the WINDOWS SYSTEM directory as svcmfte32.exe and creates 2 registry run keys to load itself at startup:

•HKEY_CURRENT_USER\ Software\Microsoft\ Windows\CurrentVersion\
Run "MainStart" = svcmfte32.exe

•HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\ Windows\CurrentVersion\
Run "MainStart" = svcmfte32.exe
The trojan uses NETSH to add itself to the Windows Firewall allowed programs list.

Latest Computer Viruses

Books, Software

Email Us | Site Map | Links