and stop, which could lead to system crashes. It has no uninstaller, and is installed in such a way that inexpert attempts to uninstall it can cause the operating system to fail to recognize existing drives. Soon after Russinovich's first post, several trojans and worms exploiting XCP's security holes appeared. Some even used the vulnerabilities to cheat in online games. Sony BMG quickly released software to remove the rootkit component of XCP from affected Microsoft Windows computers, but after Russinovich analyzed the utility, he reported in his blog that it only exacerbated the security problems and raised further concerns about privacy. Russinovich noted that the removal program merely unmasked the hidden files installed by the rootkit but did not actually remove the rootkit. He also reported that it installed additional software that could not be uninstalled. In order to download the uninstaller, he found that it was necessary to provide an e-mail address (which the Sony BMG Privacy Policy implied was added to various bulk e-mail lists) and to install an ActiveX control containing backdoor methods (marked as "safe for scripting" and thus prone to exploits). Microsoft later issued a killbit for the ActiveX control. On November 18, 2005, Sony BMG provided a "new and improved" removal tool to remove the rootkit component of XCP from affected Microsoft Windows computers. Legal and financial problems Product recall On November 15, 2005 vnunet.com announced that Sony BMG was backing out of its copy-protection software, recalling unsold CDs from all stores and allowing consumers to exchange affected CDs for versions without the software. The Electronic Frontier Foundation compiled a partial list of CDs with XCP. Sony BMG maintained that "there were no security risks associated with the anti-piracy technology" despite numerous virus and malware reports. On November 16, 2005, US-CERT, part of the United States Department of Homeland Security, issued an advisory on XCP DRM. It said that XCP uses rootkit technology to hide certain files from the user and that the technique is a security threat to users. They also said that one of the uninstallation options provided by Sony BMG introduces further vulnerabilities. US-CERT advised: "Do not install software from sources that you do not expect to contain software, such as an audio CD." Sony BMG announced that it had instructed retailers to remove any unsold music discs containing the software from their shelves. Internet-security expert Dan Kaminsky estimated that XCP