"For affected users, this represents a far greater security risk than even the Sony rootkit," said Ed Felten, a professor of computer science at the Ivy League university and author of the weblog "Freedom to Tinker."
Felten warned that the rootkit remover allows any website to run code onto a PC and take command of it.
"Any web page can seize control of your computer; then it can do anything it likes," Felten wrote on his blog. "That's about as serious a security flaw as you can get."
The uninstaller downloads a program onto PCs called CodeSupport, which remains on a unit after a user leaves Sony's site. The program is labeled as "safe for scripting," Felten contends, so a site can download code onto a PC – without user permission – by using it.
Sony had said earlier this week that it would withdraw the rootkit application from CD-Roms. A media firestorm erupted after Windows security expert Mark Russinovich first reported on the application's existence on his blog late last month.
A number of viruses, which exploited the cloaking code to download software onto PCs, appeared in the weeks following the disclosure.
Meanwhile, USA Today has reported that Sony has agreed to pull CDs containing the application from stores and offer exchanges to customers who bought CD-Roms containing the rootkit.
Copyright © SC Magazine, US edition
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @itnews.com.au to your white-listed senders.