Mr. And Mrs. Smith rootkit
by Nikola Strahija on February 16th, 2006 F-Secure warned of a DVD which uses rootkit copy protection.
The German DVD of Mr and Mrs Smith contains copy-protection software called Alpha-DVD, according to news organization Heise, which first reported the issue. The disc will not play on Windows PCs unless the software is installed. Alpha-DVD contains user-mode rootkit-like features that hide its own process, according to F-Secure.
Heise said another recent German DVD, "Edison", also contains Alpha-DVD, as does a Korean edition of "Oldboy".
Like any ill-programmed copy-protection, Alpha-DVD can be used for malicious purposes. Heise said that it was preparing a proof-of-concept application that could call on Alpha-DVD to hide itself from the OS. -It takes only a few lines of code to make use of Alpha-DVDs stealth functionality, Heise said.
As we are writing this, the manufacturer of Alpha-DVD, a South Korean company Settec, is providing removal software because Alpha-DVD does not show itself either in windows registry nor the Add-Remove service.
