Many types of malware register a CLSID under HKCU\Software\Classes\CLSID to achieve persistence. For example:
If you did not intentionally create this CLSID, you should investigate it immediately. Use reg query to check the default value:
reg query "HKCU\Software\Classes\CLSID\86CA1AA0-34AA-4e8b-A509-50C905BAE2A2\InprocServer32" /ve
If the DLL path points to %TEMP%, C:\Users\Public, or an obscure folder, it is highly suspicious.
When executed successfully, this command sets the default value of the InprocServer32 registry key to empty (or nothing). In a typical COM registration, the default value should contain the full filesystem path to the DLL that implements the COM class.
By setting it to empty (or not specifying a path), the command effectively invalidates the registration of that COM class. Any attempt to create an instance of that CLSID will fail unless another registration (e.g., per-machine in HKLM) overrides it.
reg add "HKCU\Software\Classes\CLSID\86CA1AA0-34AA-4e8b-A509-50C905BAE2A2\InprocServer32" /v ThreadingModel /t REG_SZ /d "Apartment" /f
Many types of malware register a CLSID under HKCU\Software\Classes\CLSID to achieve persistence. For example:
If you did not intentionally create this CLSID, you should investigate it immediately. Use reg query to check the default value: Many types of malware register a CLSID under
reg query "HKCU\Software\Classes\CLSID\86CA1AA0-34AA-4e8b-A509-50C905BAE2A2\InprocServer32" /ve
If the DLL path points to %TEMP%, C:\Users\Public, or an obscure folder, it is highly suspicious. If you did not intentionally create this CLSID,
When executed successfully, this command sets the default value of the InprocServer32 registry key to empty (or nothing). In a typical COM registration, the default value should contain the full filesystem path to the DLL that implements the COM class. If the DLL path points to %TEMP% ,
By setting it to empty (or not specifying a path), the command effectively invalidates the registration of that COM class. Any attempt to create an instance of that CLSID will fail unless another registration (e.g., per-machine in HKLM) overrides it.
reg add "HKCU\Software\Classes\CLSID\86CA1AA0-34AA-4e8b-A509-50C905BAE2A2\InprocServer32" /v ThreadingModel /t REG_SZ /d "Apartment" /f