USATODAY.com - Copy-protected-CD flap raises questions

Q: Just how restrictive are these XCP CDs?

A: The CDs can be played safely in most conventional CD players. But in computers, they can be played only by accepting a software download of a special media player from Sony BMG. Researchers discovered that the software contained a hidden file — called a "rootkit" — that made computers vulnerable to viruses. Microsoft and anti-spyware companies are working on solutions to find and remove the files.

Q: So what is the best way to remove the software?

A: That's another hornet's nest. A Princeton researcher, J. Alex Halderman, says Sony's uninstall program "makes the computer even more vulnerable." He has posted instructions for how to find out if your PC is infected at the Freedom to Tinker blog (www.freedom-to-tinker.com/?p=924). But he recommends consumers leave the XCP software on their computer until Sony fixes the situation. Sony says it is working on a new uninstall program.

Q: What's the worst thing that can happen to my computer?

A: Spyware writers have developed programs that can piggyback on the hidden files, potentially wreaking havoc.
CDs with copy protection
Not all copy-protected CDs have the controversial XCP software from First 4 Internet. Sony hasn't issued a list, but the number grows daily. Sony now says nearly 50 titles are affected. Here's a sampling of the XCP discs — and other copy-protected CDs as well.

Sony BMG CDs with First 4 Internet XCP copy-protection

Van Zant, Get Right with the Man

Sarah McLachlan, Bloom Remix Album

Celine Dion, On Ne Change Pas

Neil Diamond, 12 Songs

Natasha Bedingfield, Unwritten

Chris Botti, To Love Again

Pete Seeger, The Essential Pete Seeger

Cyndi Lauper, The Body Acoustic

Burt Bacharach, At This Time

Ricky Martin, Life

All-Star Tribute to Luther Vandross, So Amazing

Sony BMG CDs with SunnComm MediaMax copy-protection

Foo Fighters, In Your Honor

Santana, All That I Am

Alicia Keys, Unplugged

Switchfoot, Nothing Is Sound

Babyface, Grown & Sexy

EMI CDs with Macrovision CDS-300

Ryan Shupe & the Rubber Band, Dream Big

Jermaine Dupri presents Young Fly & Flashy Vol. 1

But tech-security researchers say even tech-savvy individuals who try to uninstall the XCP files on their own could be asking for trouble. Rob Enderle, an independent technology analyst, says the only way to get your computer back to normal is to reformat the hard drive and re-install the operating system. "A rootkit changes the operating system and is incredibly insidious," he says. "If you leave it on your machine, it will become one of those things that drive you insane with intermittent crashes and instability."

Q: How can I tell if these XCP CDs are in the racks at the store? Are they labeled?

A: Yes and no. Sony also sells copy-protected CDs with software provided by SunnComm. The company says all SunnComm and XCP discs are clearly marked, with a sticker on the cover. However, the stickers don't specify whether they are XCP or SunnComm, and not all stores carry the stickers. When USA TODAY went shopping at a Los Angeles-area Barnes & Noble store Tuesday, there was no sticker on XCP CDs from Neil Diamond, Cyndi Lauper, Chris Botti or Ricky Martin. To find an XCP disc, look on the back of the CD, where in tiny print, it says "?cp.sonybmg.com/xcp."

Q: How many people could be affected by Sony's flawed software?

A: A lot. Dan Kaminsky, an independent Internet researcher, estimates thousands of computer networks — including those for businesses, schools, government agencies and homes — were probably exposed.

Q: What about other copy-protected CDs? Are they as problematic, and how do I find them?

A: At the Barnes & Noble store, copy-protected CDs from Sony artists Alicia Keys, Santana, Babyface and Maroon 5, which use software from SunnComm, also were not labeled with a sticker. The fine print on the back of those CDs says "?www.sunncomm.com/support/sonybmg."

To listen to these CDs on a PC, you also must install special software. They aren't supposed to play in iTunes, but USA TODAY initially had no trouble playing the CDs in iTunes or saving the files to the hard drive for copying to the iPod. But that was before we clicked on the album cover icon when it showed up in My Computer. Then, we had to accept a license agreement. Once that was done, the CD would no longer play in iTunes.

Record label EMI has only a handful of copy-protected titles in U.S. release. EMI uses a different copy-protection program: CDS-300 from Macrovision.