said by bcastner:Since there is no reference to a PE type of file, the entry is harmless.
It looks to me to be a lookup table. For example, I might use the registry as a scratchpad to hold configuration settings.
It most assuredly is not a rootkit reference, and most assuredly is not an active threat. There is not there, there. The fact that it is hidden is the only interesting thing about it; but there is nothing particularly interesting about that either. If I was using the registry to record, say GUI settings, I likely would hide it so that all those who love to run registry cleaners did not zap the parameter lookup table storage area.
Without a PE reference, there is no harm and no foul.
Take the CLSID: {EB763CD6-EB61-CF33-466E-3849D06F1F61}
And use that value to
search HKLM and HKCU to see if there are additional entries that lead to something intelligible.
What do you mean when you say PE? I'm not familiar with that term in this context.
