DxO and Pace Anti-Piracy Scandal!!

I use DxO as part of my regular workflow to edit and process pictures. Its ability to enhance and correct photos is quite amazing sometimes. Over the past couple of years it has gone from a niche product to very much in the mainstream for photo editing.

However, I have recently run into some issues with the anti-piracy software that gets bundled with this program. I believe the Pace Anti-Piracy software is so malicious and shameful that I have to say something.

I paid no attention to such things with 3.5. I simply went about my business. But, the 4.1 version is something I have wanted to try since it’s the only version that supports the new Canon Rebel XTI. I checked over the Internet to see what people had to say about DxO and came across a few unusual articles. What I found was that Pace installs so much garbage and hides files all over the system that it behaves like a nasty virus. It creates directories and files with seemingly random names. It puts files in directories that have nothing to do with the program itself. It makes bogus registry entries all over the place.

I have a very serious problem with this sort of behavior. I have no issue with software vendors taking steps to protect their applications and prevent people from just making a copy and sending it out on the Internet.

What I do have a problem with is a program concealing itself, acting like files it has written to the drive belong to another program, making changes all over the place that it will never uninstall, and making changes to my machine that act way too much like a virus.

To prove what I’m talking about I used a copy of Regview to copy the registry and the file system before DxO 4.1 was installed. After the install, I compared the old and the new and got a list of all the things that had changed. I was floored!

Pace should be ashamed of itself and its protection scheme. I feel their practice of hiding files is so despicable that I can’t bring myself to actually upgrade to the 4.1 version because of the filth it lays down. I went back to the 3.5 version and removed as many of the Pace files as I could find and the program works just fine.

I feel this is a gross breach of trust between developer and user and think DxO needs to ditch Pace and contact a more respectable vendor to protect their software. I can’t believe they knowingly let this sort of behavior occur and install such garbage on user’s machines. To see what I mean, I have provided the list of files and registry changes Pace made to my machine. You decide if you think this is reasonable.

Some entries look pretty messy, but if you follow along it’s not too bad to read. I have included everything that was changed in case you want to remove Pace completely from your system. The main thing to find is the top level reg key and get rid of it, like this example:

“Added”, “HKEY_CURRENT_USER\Software\Gravity\yzTNaygC”
“Added”, “HKEY_CURRENT_USER\Software\Dog\Y23msAidKVeps”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Monitor\f08E8amRLq84″

Just delete the key for Gravity, Dog, and Monitor from the registry. And yes, those are keys Pace created. You can see the “Added” to the far left.

I don’t know if this list is complete or what other programs Pace installs with, but here is what I have.

REGISTRY KEYS CREATED BY PACE ANTI-PIRACY
Notice the bogus keys of Dog, Gravity and Monitor that get created.

“Changed”, “HKEY_CURRENT_USER\SessionInformation”, “ProgramCount”, “0x00000003 (3)”, “0x00000004 (4)”, “DWORD”
“Added”, “HKEY_CURRENT_USER\Software\{91D57664-4250-F610-B339-E4A2578BED75}”, “”, “”, “”, “”
“Added”, “HKEY_CURRENT_USER\Software\{91D57664-4250-F610-B339-E4A2578BED75}”, “PzMiHd8fyG”,
“Added”, “HKEY_CURRENT_USER\Software\Dog”, “”, “”, “”, “”
“Added”, “HKEY_CURRENT_USER\Software\DxO”, “”, “”, “”, “”
“Added”, “HKEY_CURRENT_USER\Software\DxO\DxO Optics Pro 4″, “”, “”, “”, “”
“Added”, “HKEY_CURRENT_USER\Software\Gravity”, “”, “”, “”, “”
“Changed”, “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count”, “HRZR_EHACNGU”,
“Added”, “HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache”, “C:\Download\DxO Optics Pro v4 Install\DxO Optics Pro v4 Install\Win\DxOSetup.exe”, “DxOSetup”, “”, “String”
“Added”, “HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache”, “C:\Program Files\DxO Labs\DxO Optics Pro v4\DxOOpticsPro.exe”, “DxO Optics Pro v4.0″, “”, “String”
“Added”, “HKEY_CURRENT_USER\Software\PACE Anti-Piracy”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\DOPMenu”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\DOPMenu”, “”, “{E8CF73E1-2D2B-465D-9740-8E85349FD65A}”, “”, “String”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.caf”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\DXOOpticsPro.exe\shell\open\command”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E8CF73E1-2D2B-465D-9740-8E85349FD65A}”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\DOPMenu”, “”, “”, “”, “”
“Added”,
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DOPProject.Document”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DOPProject.Document\DefaultIcon”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Classes\DxOLabs.Profile”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\DxOLabs”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\DxOLabs\DxOOpticsProv4″, “”, “”, “”,
“Changed”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG”, “Seed”,
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\DXOOpticsProv4.exe”, “”, “”, “”, “”
“Changed”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-3278977455-3212934189-930722307-1006\Products\08208435B8EDF5446967AF6E92E3605E\Usage”, “FTR_OOSEMain”, “0x362f0075 (909049973)”, “0x36300076 (909115510)”, “DWORD”

“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved”, “{E8CF73E1-2D2B-465D-9740-8E85349FD65A}”, “DOPMenu”, “”, “String”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DxO Optics Pro 4″, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\Monitor”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SOFTWARE\PACE Anti-Piracy”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TPkd”, “”, “”, “”,
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “”, “”, “”, “”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “ErrorControl”, “0x00000001 (1)”, “”, “DWORD”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “Group”, “filter”, “”, “String”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “Start”, “0x00000000 (0)”, “”, “DWORD”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd”, “Type”, “0x00000001 (1)”, “”, “DWORD”
“Added”, “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPkd\Devices”, “”, “”, “”, “”
“Changed”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\SessionInformation”, “ProgramCount”, “0x00000003 (3)”, “0x00000004 (4)”, “DWORD”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\{91D57664-4250-F610-B339-E4A2578BED75}”, “”, “”, “”, “”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\{91D57664-4250-F610-B339-E4A2578BED75}”, “PzMiHd8fyG”,
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Dog”, “”, “”, “”, “”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\DxO\DxO Optics Pro 4″, “”, “”, “”, “”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Gravity”, “”, “”, “”, “”
“Changed”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count”, “Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache”, “C:\Download\DxO Optics Pro v4 Install\DxO Optics Pro v4 Install\Win\DxOSetup.exe”, “DxOSetup”, “”, “String”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\Microsoft\Windows\ShellNoRoam\MUICache”, “C:\Program Files\DxO Labs\DxO Optics Pro v4\DxOOpticsPro.exe”, “DxO Optics Pro v4.0″, “”, “String”
“Added”, “HKEY_USERS\S-1-5-21-3278977455-3212934189-930722307-1006\Software\PACE Anti-Piracy”, “”, “”, “”, “”

FILES INSTALLED BY PACE ANTI-PIRACY
Notice the fake cookies, bogus XLS files and random folder names that get created! And I don’t really see where Pace gets off adding files to the Microsoft folder!! Even junk XLS files are made in the Internet Cache.

“Changed”, “C:\Documents and Settings\All Users\Application Data”
“Changed”, “C:\Documents and Settings\All Users\Application Data\Microsoft”
“Added”, “C:\Documents and Settings\All Users\Application Data\Microsoft\sk5NRRcHayLr5″
“Added”, “C:\Documents and Settings\All Users\Application Data\Microsoft\sk5NRRcHayLr5\gxKvDkaHnJpN2.dat”
“Added”, “C:\Documents and Settings\All Users\Application Data\Microsoft\zwepiDOrA4″
“Added”, “C:\Documents and Settings\All Users\Application Data\Microsoft\zwepiDOrA4\lCHZd7gDQ.fn_”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files\Activations”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files\Hidden”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files\Obsolete”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\License Files\Shortcuts”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\TXbpcUko3UvXjh”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\TXbpcUko3UvXjh\tybJbsiyp4GU.txt”

“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\zzKAhdb20W”
“Added”, “C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy\zzKAhdb20W\I3nmMBeHwrkD.va_”
“Changed”, “C:\Documents and Settings\UserName\Application Data”
“Changed”, “C:\Documents and Settings\UserName\Application Data\IDMComp\UltraEdit\uedit32.INI”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy\bnj1mnWC”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy\bnj1mnWC\JdbhRHIPZv6.dtc”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy\C6Z60l8HWH”
“Added”, “C:\Documents and Settings\UserName\Application Data\PACE Anti-Piracy\C6Z60l8HWH\JAoeFpgrX.006″
“Changed”, “C:\Documents and Settings\UserName\Cookies”
“Added”, “C:\Documents and Settings\UserName\Cookies\UserName@a73ow4ZPhvZ_[1].txt”
“Added”, “C:\Documents and Settings\UserName\Cookies\UserName@ENc5521zL_[1].txt”

“Added”, “C:\Documents and Settings\UserName\Cookies\UserName@www.yohie[1].txt”
“Added”, “C:\Documents and Settings\UserName\Cookies\UserName@www.yuhui[1].txt”

“Changed”, “C:\Documents and Settings\UserName\Cookies\index.dat”
“Added”, “C:\Documents and Settings\UserName\Cookies\Qrbos8nVW1″
“Changed”, “C:\Documents and Settings\UserName\Desktop”
“Added”, “C:\Documents and Settings\UserName\Desktop\DxO Optics Pro v4.lnk”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\Application Data”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Application Data\bpcUko3UvXjhw”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Application Data\bpcUko3UvXjhw\tybJbsiyp4GU.txt”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Application Data\gl5jTAF2F9z8W”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Application Data\PACE Anti-Piracy”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\History\History.IE5\index.dat”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\Temp”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temp\Edit.000″
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temp\PTM127.tmp”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temp\Tpkdboot.reg”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files”
“Changed”, “C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files\Content.IE5\index.dat”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files\XI1nnJ210iGNp”
“Added”, “C:\Documents and Settings\UserName\Local Settings\Temporary Internet Files\XI1nnJ210iGNp\0GOiptSk.xls”
“Changed”, “C:\Documents and Settings\UserName\My Documents”
“Changed”, “C:\Documents and Settings\UserName\ntuser.dat.LOG”
“Changed”, “C:\Documents and Settings\UserName\Start Menu\Programs”
“Added”, “C:\Documents and Settings\UserName\Start Menu\Programs\DxO Optics Pro v4″
“Added”, “C:\Documents and Settings\UserName\Start Menu\Programs\DxO Optics Pro v4\DxO Optics Pro v4.lnk”
“Added”, “C:\Documents and Settings\UserName\Start Menu\Programs\DxO Optics Pro v4\Uninstall.lnk”
“Changed”, “C:\Program Files\Common Files”
“Changed”, “C:\Program Files\Common Files\Microsoft Shared”
“Added”, “C:\Program Files\Common Files\Microsoft Shared\6ohi2y9lLM8s”
“Added”, “C:\Program Files\Common Files\PACE Anti-Piracy”
“Added”, “C:\Program Files\Common Files\PACE Anti-Piracy\Log Files”
“Added”, “C:\Program Files\Common Files\PACE Anti-Piracy\Log Files\Auth.log”
“Changed”, “C:\Program Files\DxO Labs”
“Added”, “C:\Program Files\DxO Labs\DxO Optics Pro v4″

“Changed”, “C:\WINDOWS\CAVTemp”
“Changed”, “C:\WINDOWS\Prefetch”
“Added”, “C:\WINDOWS\Prefetch\DXOOPTICSPRO.EXE-1E72A84B.pf”
“Added”, “C:\WINDOWS\Prefetch\DXOSETUP.EXE-20FE06D0.pf”
“Changed”, “C:\WINDOWS\system32\drivers”
“Added”, “C:\WINDOWS\system32\drivers\TPkd.sys”

This information is provided to help you remove Pace Anti-Piracy from your machine

If you want to learn more you can do a search for “Pace Anti Piracy remove tpkd.sys”. You will also see dozens of articles on Pace causing machines problems because of it’s poorly written code and system driver. This really is a loser protection scheme and I wish DxO would stop using them.

A couple of articles for you to read which started me on this quest.

http://q.queso.com/archives/001606

http://www.pfarrell.com/prc/pace.html 

Other Articles of Interest:
    None Found

12 Responses to “DxO and Pace Anti-Piracy Scandal!!”

  • Lance:

    Thanks for the help. I found some of their b.s. on my computer. Douche bags!

  • Wow, how very interesting. This is just dumb on DxO’s part. Like you said, they definitely need to protect their IP, but they should also do proper research to not utilize a crappy product to get that done. Well, I definitely won’t be installing DxO anytime soon. Thanks for the info.

    On a side note, I did a search on Google for “Pace anti-piracy” and this blog was fifth on the list. A couple others calling shenanigans on Pace also showed up; so at least we can hope people are getting the info. I would be embarrassed if I worked for Pace and found that a search for my company name showed results like this in the top 10. They could at least do like any other well respected, seedy company and pad the search results with their own propaganda.

  • […] vous voulez avoir une idée de la foule de modifications apportée par l’installation de DxO, voyez ce lien. Pour ma part, voici le log des logiciels installés (par ordre chronologique) entre […]

  • […] looking to cure my problems, I also came across this. So computer audio musos aren’t the only ones who are occasionally taken down. Gamers are […]

  • Dandroid:

    If anyone has a simple, step by step explanation as to how I can remove any, and all, PACE crap from my G5 I would LOVE to hear from you!!!

    My computer’s been crashing for a while now, and I can’t get any work done thanks to these underhand scumbags………short of a fresh install I don’t know what to do!!!!!

    Please contact me at dandroid76@lycos.com

  • DxO Adware Spyware Virus Spam Rubbish:

    Thanks for your info! I installed DxO to have a look and quickly uninstalled it after seeing all the rubbish that it co-installed. Your loss DxO, you are losing sales because of this rubbish!

  • Mr T:

    I will never read another newsletter from DXO that I keep getting spammed with again… Never mind let one of their Value added installers near my systems again…. shocking!

  • many scanners block PACE as it “acts” just like
    every other spyware, malware, and virus by
    providing no informed consent, hiding that it was installed,
    including no explicit uninstall, activley preventing removal
    and inducing system “issues” in most laptops or netbooks

    I got a 3d web and program builder that made codeing easy ,
    when you make something the client browser used
    a 500k plugin ,, BUT then unity3d (and maybe its browser plugin)
    installed “PACE Anti-Piracy” and TPkd.sys ,,,,
    FAIL!

  • Reticuli:

    I installed the demo for Avid Torq 2.02 and it asked me if I agreed to Pace being installed. I clicked No and it installed in the background anyway. Under services.msc I can see it running in there. Isn’t that technically a felony behavior for a software company? It’s against laws passed by Congress regarding viruses, computer piracy, and malicious software. If you click No and it installs anyway, that company committed a crime, can be prosecuted, and you furthermore have civil standing in court against them. BMI was fined and sued extensively by the federal government and states around the country for that kind of behavior with software that did far less to your computer than Pace apparently does. Since it installed, Virtual DJ now longer works correctly. It was fine before, now it crashes constantly and re-installing VDJ won’t fix it. I say this is begging for a class-action suit as occurred against BMI.

  • Reticuli:

    sorry, against Pace, like BMI.

  • xPreatorianx:

    What they are doing is obfuscating (I hope that’s the right word.) the registry settings in a horrible effort to deter pirates from simply copying all the needed files and bundling them in another installer. Basically it’s security by obscurity. They sit there and produce a whole shit load of registry keys plus bogus files in an effort to hide the real critical files. But the funny thing is most monitoring software can pick it all up like you did with the post, so it’s already negated.

Leave a Reply