8×10Gallery.com

I use DxO as part of my regular workflow to edit and process pictures. Its ability to enhance and correct photos is quite amazing sometimes. Over the past couple of years it has gone from a niche product to very much in the mainstream for photo editing.

However, I have recently run into some issues with the anti-piracy software that gets bundled with this program. I believe the Pace Anti-Piracy software is so malicious and shameful that I have to say something.

I paid no attention to such things with 3.5. I simply went about my business. But, the 4.1 version is something I have wanted to try since it’s the only version that supports the new Canon Rebel XTI. I checked over the Internet to see what people had to say about DxO and came across a few unusual articles. What I found was that Pace installs so much garbage and hides files all over the system that it behaves like a nasty virus. It creates directories and files with seemingly random names. It puts files in directories that have nothing to do with the program itself. It makes bogus registry entries all over the place.

I have a very serious problem with this sort of behavior. I have no issue with software vendors taking steps to protect their applications and prevent people from just making a copy and sending it out on the Internet.

What I do have a problem with is a program concealing itself, acting like files it has written to the drive belong to another program, making changes all over the place that it will never uninstall, and making changes to my machine that act way too much like a virus.

To prove what I’m talking about I used a copy of Regview to copy the registry and the file system before DxO 4.1 was installed. After the install, I compared the old and the new and got a list of all the things that had changed. I was floored!

Pace should be ashamed of itself and its protection scheme. I feel their practice of hiding files is so despicable that I can’t bring myself to actually upgrade to the 4.1 version because of the filth it lays down. I went back to the 3.5 version and removed as many of the Pace files as I could find and the program works just fine.

I feel this is a gross breach of trust between developer and user and think DxO needs to ditch Pace and contact a more respectable vendor to protect their software. I can’t believe they knowingly let this sort of behavior occur and install such garbage on user’s machines. To see what I mean, I have provided the list of files and registry changes Pace made to my machine. You decide if you think this is reasonable.

Some entries look pretty messy, but if you follow along it’s not too bad to read. I have included everything that was changed in case you want to remove Pace completely from your system. The main thing to find is the top level reg key and get rid of it, like this example:

“Added”, “HKEY_CURRENT_USER\Software\Gravity\yzTNaygC”
“Added”, “HKEY_CURRENT_USER\Software\Dog\Y23msAidKVeps”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Monitor\f08E8amRLq84″

Just delete the key for Gravity, Dog, and Monitor from the registry. And yes, those are keys Pace created. You can see the “Added” to the far left.

I don’t know if this list is complete or what other programs Pace installs with, but here is what I have.

REGISTRY KEYS CREATED BY PACE ANTI-PIRACY
Notice the bogus keys of Dog, Gravity and Monitor that get created.

“Changed”, “HKEY_CURRENT_USER\SessionInformation”, “ProgramCount”, “0×00000003 (3)”, “0×00000004 (4)”, “DWORD”
“Added”, “HKEY_CURRENT_USER\Software\{91D57664-4250-F610-B339-E4A2578BED75}”, “”, “”, “”, “”
“Added”, “HKEY_CURRENT_USER\Software\{91D57664-4250-F610-B339-E4A2578BED75}”, “PzMiHd8fyG”,
“Added”, “HKEY_CURRENT_USER\Software\Dog”, “”, “”, “”, “”
“Added”, “HKEY_CURRENT_USER\Software\DxO”, “”, “”, “”, “”
“Added”, “HKEY_CURRENT_USER\Software\DxO\DxO Optics Pro 4″, “”, “”, “”, “”
“Added”, “HKEY_CURRENT_USER\Software\Gravity”, “”, “”, “”, “”
“Changed”, “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count”, “HRZR_EHACNGU”,
“Added”, “HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache”, “C:\Download\DxO Optics Pro v4 Install\DxO Optics Pro v4 Install\Win\DxOSetup.exe”, “DxOSetup”, “”, “String”
“Added”, “HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache”, “C:\Program Files\DxO Labs\DxO Optics Pro v4\DxOOpticsPro.exe”, “DxO Optics Pro v4.0″, “”, “String”
“Added”, “HKEY_CURRENT_USER\Software\PACE Anti-Piracy”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\DOPMenu”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\DOPMenu”, “”, “{E8CF73E1-2D2B-465D-9740-8E85349FD65A}”, “”, “String”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.caf”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\DXOOpticsPro.exe\shell\open\command”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E8CF73E1-2D2B-465D-9740-8E85349FD65A}”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\DOPMenu”, “”, “”, “”, “”
“Added”,
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DOPProject.Document”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DOPProject.Document\DefaultIcon”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DxOLabs.Profile”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\DxOLabs”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\DxOLabs\DxOOpticsProv4″, “”, “”, “”,
“Changed”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG”, “Seed”,
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\DXOOpticsProv4.exe”, “”, “”, “”, “”
“Changed”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-3278977455-3212934189-930722307-1006\Products\08208435B8EDF5446967AF6E92E3605E\Usage”, “FTR_OOSEMain”, “0×362f0075 (909049973)”, “0×36300076 (909115510)”, “DWORD”

“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved”, “{E8CF73E1-2D2B-465D-9740-8E85349FD65A}”, “DOPMenu”, “”, “String”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DxO Optics Pro 4″, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Monitor”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\PACE Anti-Piracy”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TPkd”, “”, “”, “”,
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “ErrorControl”, “0×00000001 (1)”, “”, “DWORD”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “Group”, “filter”, “”, “String”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “Start”, “0×00000000 (0)”, “”, “DWORD”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “Type”, “0×00000001 (1)”, “”, “DWORD”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd\Devices”, “”, “”, “”, “”
“Changed”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\SessionInformation”, “ProgramCount”, “0×00000003 (3)”, “0×00000004 (4)”, “DWORD”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\{91D57664-4250-F610-B339-E4A2578BED75}”, “”, “”, “”, “”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\{91D57664-4250-F610-B339-E4A2578BED75}”, “PzMiHd8fyG”,
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Dog”, “”, “”, “”, “”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\DxO\DxO Optics Pro 4″, “”, “”, “”, “”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Gravity”, “”, “”, “”, “”
“Changed”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count”, “Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache”, “C:\Download\DxO Optics Pro v4 Install\DxO Optics Pro v4 Install\Win\DxOSetup.exe”, “DxOSetup”, “”, “String”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache”, “C:\Program Files\DxO Labs\DxO Optics Pro v4\DxOOpticsPro.exe”, “DxO Optics Pro v4.0″, “”, “String”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\PACE Anti-Piracy”, “”, “”, “”, “”

FILES INSTALLED BY PACE ANTI-PIRACY
Notice the fake cookies, bogus XLS files and random folder names that get created! And I don’t really see where Pace gets off adding files to the Microsoft folder!! Even junk XLS files are made in the Internet Cache.

“Changed”, “C:\Documents and Settings\All Users\Application Data”
“Changed”, “C:\Documents and Settings\All Users\Application Data\Microsoft”
“Added”, “C:\Documents and Settings\All Users\Application Data\Microsoft\sk5NRRcHayLr5″
“Added”, “C:\Documents and Settings\All Users\Application Data\Microsoft\sk5NRRcHayLr5\gxKvDkaHnJpN2.dat”
“Added”, “C:\Documents and Settings\All Users\Application Data\Microsoft\zwepiDOrA4″
“Added”, “C:\Documents and Settings\All Users\Application Data\Microsoft\zwepiDOrA4\lCHZd7gDQ.fn_”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files\Activations”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files\Hidden”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files\Obsolete”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files\Shortcuts”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\TXbpcUko3UvXjh”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\TXbpcUko3UvXjh\tybJbsiyp4GU.txt”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\zzKAhdb20W”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\zzKAhdb20W\I3nmMBeHwrkD.va_”
“Changed”, “C:\Documents and Settings\UserName\Application Data”
“Changed”, “C:\Documents and Settings\UserName\Application Data\IDMComp\UltraEdit\uedit32.INI”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy\bnj1mnWC”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy\bnj1mnWC\JdbhRHIPZv6.dtc”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy\C6Z60l8HWH”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy\C6Z60l8HWH\JAoeFpgrX.006″
“Changed”, “C:\Documents and Settings\UserName\Cookies”
“Added”, “C:\Documents and Settings\UserName\Cookies\UserName@a73ow4ZPhvZ_[1].txt”
“Added”, “C:\Documents and Settings\UserName\Cookies\UserName@ENc5521zL_[1].txt”
“Added”, “C:\Documents and Settings\UserName\Cookies\UserName@www.yohie[1].txt”
“Added”, “C:\Documents and Settings\UserName\Cookies\UserName@www.yuhui[1].txt”
“Changed”, “C:\Documents and Settings\UserName\Cookies\index.dat”
“Added”, “C:\Documents and Settings\UserName\Cookies\Qrbos8nVW1″
“Changed”, “C:\Documents and Settings\UserName\Desktop”
“Added”, “C:\Documents and Settings\UserName\Desktop\DxO Optics Pro v4.lnk”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\Application Data”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Application Data\bpcUko3UvXjhw”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Application Data\bpcUko3UvXjhw\tybJbsiyp4GU.txt”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Application Data\gl5jTAF2F9z8W”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Application Data\PACE Anti-Piracy”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\History\History.IE5\index.dat”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\Temp”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temp\Edit.000″
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temp\PTM127.tmp”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temp\Tpkdboot.reg”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files\Content.IE5\index.dat”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files\XI1nnJ210iGNp”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files\XI1nnJ210iGNp\0GOiptSk.xls”
“Changed”, “C:\Documents and Settings\UserName\My Documents”
“Changed”, “C:\Documents and Settings\UserName\ntuser.dat.LOG”
“Changed”, “C:\Documents and Settings\UserName\Start Menu\Programs”
“Added”, “C:\Documents and Settings\UserName\Start Menu\Programs\DxO Optics Pro v4″
“Added”, “C:\Documents and Settings\UserName\Start Menu\Programs\DxO Optics Pro v4\DxO Optics Pro v4.lnk”
“Added”, “C:\Documents and Settings\UserName\Start Menu\Programs\DxO Optics Pro v4\Uninstall.lnk”
“Changed”, “C:\Program Files\Common Files”
“Changed”, “C:\Program Files\Common Files\Microsoft Shared”
“Added”, “C:\Program Files\Common Files\Microsoft Shared\6ohi2y9lLM8s”
“Added”, “C:\Program Files\Common Files\PACE Anti-Piracy”
“Added”, “C:\Program Files\Common Files\PACE Anti-Piracy\Log Files”
“Added”, “C:\Program Files\Common Files\PACE Anti-Piracy\Log Files\Auth.log”
“Changed”, “C:\Program Files\DxO Labs”
“Added”, “C:\Program Files\DxO Labs\DxO Optics Pro v4″

“Changed”, “C:\WINDOWS\CAVTemp”
“Changed”, “C:\WINDOWS\Prefetch”
“Added”, “C:\WINDOWS\Prefetch\DXOOPTICSPRO.EXE-1E72A84B.pf”
“Added”, “C:\WINDOWS\Prefetch\DXOSETUP.EXE-20FE06D0.pf”
“Changed”, “C:\WINDOWS\system32\drivers”
“Added”, “C:\WINDOWS\system32\drivers\TPkd.sys”

This information is provided to help you remove Pace Anti-Piracy from your machine

If you want to learn more you can do a search for “Pace Anti Piracy remove tpkd.sys”. You will also see dozens of articles on Pace causing machines problems because of it’s poorly written code and system driver. This really is a loser protection scheme and I wish DxO would stop using them.

A couple of articles for you to read which started me on this quest.

http://q.queso.com/archives/001606

http://www.pfarrell.com/prc/pace.html