Bruce Schneier has a great editorial on Wired News that asks why anti-virus companies — who would normally address a rootkit or similar piece of software within hours — didn't notice Sony's rootkit, which had been in place since mid-2004? Also: why did they initially refuse to patch against it? Who do these companies work for — us, or the entertainment industry?
Symantec's response to the rootkit has, to put it kindly, evolved. At first the company didn't consider XCP malware at all. It wasn't until Nov. 11 that Symantec posted a tool to remove the cloaking. As of Nov. 15, it is still wishy-washy about it, explaining that "this rootkit was designed to hide a legitimate application, but it can be used to hide other objects, including malicious software."
The only thing that makes this rootkit legitimate is that a multinational corporation put it on your computer, not a criminal organization.
You might expect Microsoft to be the first company to condemn this rootkit. After all, XCP corrupts Windows' internals in a pretty nasty way. It's the sort of behavior that could easily lead to system crashes — crashes that customers would blame on Microsoft. But it wasn't until Nov. 13, when public pressure was just too great to ignore, that Microsoft announced it would update its security tools to detect and remove the cloaking portion of the rootkit.
