Bruce Schneier has a good summary of the mess - and he looks places that a lot of us missed. He points out that the anti-virus manufacturers were (and are) in the tank on this one - even MS, hailed for announcing that their tool would remove the malware, was very, very late to the party:

The story to pay attention to here is the collusion between big media companies who try to control what we do on our computers and computer-security companies who are supposed to be protecting us.

Initial estimates are that more than half a million computers worldwide are infected with this Sony rootkit. Those are amazing infection numbers, making this one of the most serious internet epidemics of all time -- on a par with worms like Blaster, Slammer, Code Red and Nimda.

What do you think of your antivirus company, the one that didn't notice Sony's rootkit as it infected half a million computers? And this isn't one of those lightning-fast internet worms; this one has been spreading since mid-2004. Because it spread through infected CDs, not through internet connections, they didn't notice? This is exactly the kind of thing we're paying those companies to detect -- especially because the rootkit was phoning home.

But much worse than not detecting it before Russinovich's discovery was the deafening silence that followed. When a new piece of malware is found, security companies fall over themselves to clean our computers and inoculate our networks. Not in this case.

That is an amazing thing, and Bruce is the first (that I've seen) to bring it up. Read his whole post - some of the companies have really, really lame excuses. It does end up sounding a lot like collusion.