Sony BMG has settled two more lawsuits over CDs sold by the company that included a hidden copy-protection program that could be used by hackers to hide computer viruses.

The company announced on Tuesday it will pay $1.5 million US and pay thousands more in customer refunds after settling lawsuits in California and Texas.

The settlements come months after Sony settled with Canadian consumers over the CDs containing one of two types of copyright protection software — MediaMax or XCP.

The copy protection software, called Extended Copy Protection or XCP, is installed when the CD is put into a computer. The program uses a technique called a rootkit to hide the fact that it is running, making it more difficult to disable.

Security experts say the Sony program wasn't itself harmful. However, the program remains active on the computer even when the CD isn't being played and at least one computer virus has been written to hide behind the same cloak.

Three suits were filed in Canada. The first, affecting customers in every province except British Columbia and Quebec, was settled in September. The other two provinces reached settlements later in the year.

Under terms of the separate U.S. settlements, Sony will pay $750,000 to each of the states in civil penalties and costs and reimburse customers whose computers were damaged during attempts to uninstall the software.

"Companies that want to load their CDs with software that limits the ability to copy music should fully inform consumers about it, not hide it, and make sure it doesn't inflict security vulnerabilities on computers," California Attorney General Bill Lockyer said in a statement.

Corrections and Clarifications

  • The software Sony used was a rootkit, not spyware, as originally written in the headline. As well, the technology was not used to read and transmit IP addresses back to the company. Dec. 20, 2006|4:30 p.m. ET
With files from the Associated Press