I recently purchased Imogen Heap's new CD (Speak for Yourself), an RCA Victor release, but with distribution credited to Sony/BMG. Reading recent reports of a Sony rootkit, I decided to poke around. In addition to the standard volume for AIFF files, there's a smaller extra partition for "enhanced" content. I was surprised to find a "Start.app" Mac application in addition to the expected Windows-related files. Running this app brings up a long legal agreement, clicking Continue prompts you for your username/password (uh-oh!), and then promptly exits. Digging around a bit, I find that Start.app actually installs 2 files: PhoenixNub1.kext and PhoenixNub12.kext.
Hmmmm... not good. I was not aware of this until you brought it to my attention. I will see what I can find out.
The one saving grace is that for Mac users, the administrator name and password is required before it is installed. At least, we know that something is being installed... not WHAT is being installed, but we have a chance to say no. If it turns out that Sony's intrusive software is otherwise innocuous for other than DRM, one can choose to accept it to listen to their music. . . if you trust Sony. I don't.