Starkdog - Possibly. It is not 'recompiling' the OS. It is just patching the kernel's system service table. What this means is that there is a table of functions in the kernel (low-level OS system calls) and they are being rerouted to functions in the Rootkit service. kawecki - You must read the article that steerpike provided: http://www.sysinternals.com/blog/2005/10/sony-rootkits-and-digital-rights.html I don't think this service will show up under a normal check. Maybe the Memory Dump would show it, but there are more ramifications than the service itself. It installs the service, modifies the OS kernel, and adds Registry keys. Even if you find the service, stopping it is not enough.

C makes it easy to shoot yourself in the foot. C++ makes it harder, but when you do, you blow your whole leg off.

 -- Bjarne Stroustrup

Contact Me | Kuroyume's DevelopmentZone