In October 2005, a U.S. programmer discovered that XCP software on a Sony music CD had installed copy-restriction software on his computer that was hidden using a 'rootkit'. Later, antivirus companies found that another type of Sony DRM, MediaMax, also posed a security risk after discovering Trojan horses that exploited XCP to avoid detection.
The next month, a number of individuals filed cases against Sony at courts across United States, this despite the effort of the company to implement the CD recall scheme. In the settlement, Sony offered to replace XCP CDs with non-content-protected CDs. To “ensure that XCP CDs are promptly removed from the market,” Sony also agreed to grant incentives to U.S. customers.
By December, the cases were granted class action status. Promptly, before the year ended, Sony struck a deal with the plaintiffs by compensating buyers of CDs that contained the XCP and MediaMax DRM programs. It also offered to provide software utilities to allow consumers to uninstall both types of software from their computer.