The state of Texas sued Sony BMG, alleging that the company "surreptitiously" installed spyware on personal computers through music CDs with a copy protection program.
"Sony has engaged in a technological version of cloak and dagger deceit against consumers by hiding secret files on their computers," said Texas Attorney General Greg Abbott in a statement after suing under the state's anti-spyware law.
"Consumers who purchased a Sony CD thought they were buying music. Instead, they received spyware that can damage a computer, subject it to viruses and expose the consumer to possible identity crime."...
The only way I know Sony can do this is for the music CD to also have a Joliet filesystem session on it with an Autorun.ini file. In which case, disable autorun for all questionable CDs (under My Computer, open the Properties popup menu on the CD drive).