Rootkit.hiddenvalue@0

riggers · January 25, 2011, 2:50pm

Just looking at the scan results for my old mans XP pro box and i keep getting (after a full scan) the entry`s

Rootkiy.hiddenvalue@0 for

HKEY_USER\Software\Microsoft\Windows\CurrentVersion\Run\CTFMON.EXE
HKEY_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\nltide_3
HKEY_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load

I try and use the Clean or Disinfect and it states “Not all threats have been removed” Infact it doesnt remove any of them, subsequent scans still show them. The keys arent present in regedit
Scanned with GMER/Sophos anti-rootkit and all seems fine. Scanned from Avira disc, no problem.

Any thoughts on this anyone?

Cheers,
Matty

e_xistense · January 25, 2011, 3:36pm

Hi Matty_R,

Can you please export the detected keys from registry, find the corresponding files to whom registry data refer to, and submit them to us?

Thanks and regards,
Ionel

riggers · January 26, 2011, 12:35pm

Hi Ionel,

The keys are not present in the registry. At least regedit doesnt show them to be there (will try with regalyzer in a bit). Show hidden is ticked/Hide protected is unticked. Any other things i could try? Cant understand why these are being flagged when there not present ???

Cheers,
Matty

dontbetonit · January 27, 2011, 10:54pm

I to have had rootkit discovered with scan of critical areas. When I tried to have Comodo remove 58 registry entries it failed. I have done this several times and they are stuck and fail to remove.
Here is the registry keys found by CIS:

Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32\cd042efbbd7f7af1647644e76e06692b
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32\bca643cdc5c2726b20d2ecedcc62c59b
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32\2c81e34222e8052573023a60d06dd016
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32\2582ae41fb52324423be06337561aa48
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32\caaeda5fd7a9ed7697d9686d4b818472
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32\a4a1bcf2cc2b8bc3716b74b2b4522f5d
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32\4d370831d2c43cd13623e232fed27b7b
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32\1d68fe701cdea33e477eb204b76f993d
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32\1fac81b91d8e3c5aa4b0a51804d844a3
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32\f5f62a6129303efb32fbe080bb27835b
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32\ThreadingModel
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32\fd4e2e1a3940b94dceb5a6a021f2e3c6
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32\8a8aec57dd6508a385616fbc86791ec2
Rootkit.HiddenValue@0 HKEY_LOCAL_MACHINE\Software\Classes\CLSID{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32\ThreadingModel

ChalkTrauma · January 28, 2011, 9:17pm

These registry keys were driving me nuts too, RootkitRevealer turned up the same ones because they have embedded nulls.

Do you currently have or ever had Pinnacle Studio 9 installed? They are apparently using rootkit methods to hide registration information… and they are using the following keys:


Details: HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}
Details: HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}
Details: HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}
Details: HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}
Details: HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}
Details: HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}
Details: HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}
Details: HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}
Details: HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}
Details: HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}
Details: HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}
Details: HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}

Why companies have to do stuff like this is beyond me… I lost like half a day tracking this down. I’m telling you right now I will not buy or install another Pinnacle product… >:(

Information here: Safer-Networking Forums

…have a better one…

norain · February 4, 2011, 10:30am

I also have the rootkit detection, yet cannot remove it like the first poster in this thread.
Should I worry?
The keys don’t show up at all in regedit, as others have said.

slightly_concerned · March 19, 2011, 8:38pm

hey so these were confirmed FP’s in your case, right?

i posted already a couple of times in another thread about this, it just drives me crazy to see that rootkit alert on my regular scan each time :-\

Trusty65 · May 16, 2011, 1:50pm

I have the same problem:
Rootkit.HiddenValue@0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\CTFMON.EXE
Rootkit.HiddenValue@0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\tscuninstall

CIS reports them but is unable to do anything about them.

Regedit shows the CTFMON key (Data C:\WINDOWS\system32\ctfmone.exe) but not the tscuninstall key.

XP Pro

Are these actual problems or false reports?

Trusty65

fOrTy_7 · May 22, 2011, 3:58pm

I’ve got these after full system scan:

Rootkit.HiddenValue[at]0 HKEY_LOCAL_MACHINE\System\ControlSet001\services\sptd\Cfg\h0 Rootkit.HiddenKey[at]0 HKEY_LOCAL_MACHINE\System\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Rootkit.HiddenValue[at]0 HKEY_LOCAL_MACHINE\System\ControlSet001\services\sptd\Cfg\s1 Rootkit.HiddenValue[at]0 HKEY_LOCAL_MACHINE\System\ControlSet001\services\sptd\Cfg\s2 Rootkit.HiddenValue[at]0 HKEY_LOCAL_MACHINE\System\ControlSet001\services\sptd\Cfg\h0 Rootkit.HiddenValue[at]0 HKEY_LOCAL_MACHINE\System\ControlSet001\services\sptd\Cfg\g0

I believe these are FPs and the entries are releated to SCSI Pass Through Direct (SPTD) layer (64 bit) (Daemon Tools Lite driver). Could you verify that?

CIS version: 5.4.189822.1355
AV database version: 8794

fOrTy_7 · July 12, 2011, 6:12pm

bump

StenneG · July 17, 2011, 7:18am

I have a similar problem:

Rootkit.HiddenValue@0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\CTFMON.EXE Risk: High

CIS reports but is unable to do anything about it.

XP Pro

mirk1989 · July 27, 2011, 11:33am

I have the same problem of dontbetonit

58 Rootkit.HiddenValue@0 due to Pinnacle Studio…

There are not solutions to avoid these FPs since they are harmless?

Thanks

Puniksem · September 28, 2012, 7:54am

ChalkTrauma post:5:

These registry keys were driving me nuts too, RootkitRevealer turned up the same ones because they have embedded nulls.

Do you currently have or ever had Pinnacle Studio 9 installed? They are apparently using rootkit methods to hide registration information… and they are using the following keys:
Details: HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}
Details: HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}
Details: HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}
Details: HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}
Details: HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}
Details: HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}
Details: HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}
Details: HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}
Details: HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}
Details: HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}
Details: HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}
Details: HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}
Why companies have to do stuff like this is beyond me… I lost like half a day tracking this down. I’m telling you right now I will not buy or install another Pinnacle product… >:(

Information here: Safer-Networking Forums

…have a better one…

I too was recently concerned by the untimely find of no less than 58 instances found on a Comodo AV scan of Rootkit.HiddenValue0 however now you mention that Pinnacle have something to do with it, it’s understandable, I too have a Pinnacle USB 70e dongle installed.

I agree that while this method of installation is not appropriate behaviour it also leads to other vulnerabilities. I noticed that after setting Comodo to scan for rootkits, the option was unticked after the first scan, therefore any further scans would not include rootkit scanning by Comodo AV.

Like you a day wasted trying to either remove these very stubborn entries, or find out information about them, I was generally getting nowhere until I read about Pinnacle being a possible culprit.

siketa · September 28, 2012, 8:53am

Rootkit.HiddenValue detections should be fixed in CIS 6.

khanyash · September 28, 2012, 11:05am

These detections only appear with advanced rootkit scanning enabled, right?

siketa · September 28, 2012, 12:45pm

I think so…

cmc · September 28, 2012, 5:39pm

Yes, for the first time in past several years I turned advanced rootkit scan on and the following, for the first time ever was listed. Cannot be removed and could not be reported as false positive either. Smart scan reveals:

“Rootkit.HiddenKey[at]0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run”

Attempt to quarantine:

“Not all threats have been successfully quarantined”

Rescan detects the same nonsense. Turned off rootkit scan and no problem detected.
Malwarebytes, SAS, TDSSKiller,… do not show any problem.

khanyash · September 28, 2012, 5:45pm

Advanced Rootkit Scan is for expert users & can give false positives.

I have observed mostly when it fails to remove any detection, either the detection is FP or not present, so in a way it is good but hope it doesn’t fail to remove the real malware. On my system advanced rootkit scan enabled never detected anything.