Sony BMG Music Entertainment has agreed to pay $4.25 million in a settlement with 39 states over malicious digital rights management software the music giant surreptitiously installed on CDs last year.