Ghost Clink in CMD: Forensic Diagnosis and Definitive Removal on Windows 10

Operating Environment: Windows 10 22H2 (build 19045.5131) Presented Symptom: The Clink v1.7.6 banner unexpectedly appears upon opening CMD without an apparent installation. Operational Risk: An unmanaged shell behavior generating noise across automation scripts and system tooling.

When a utility executes without existing in the system PATH, an explicit startup trigger exists somewhere in the execution chain. This guide documents the forensic procedure used to isolate the root cause and complete clean removal.

1) Standard vector: Command Processor AutoRun#

The primary suspect when CMD behaves abnormally is the AutoRun registry key:

reg query "HKCU\Software\Microsoft\Command Processor" /v AutoRun
reg query "HKLM\Software\Microsoft\Command Processor" /v AutoRun

In this incident, neither key was configured. Conclusion: standard registry AutoRun vector ruled out.

2) Windows Terminal: the common blind spot#

In environments utilizing Windows Terminal, shell modifications often reside directly in profile settings:

1. Open Windows Terminal Settings (Ctrl + ,).
2. Open the JSON configuration file.
3. Inspect the profile assigned to cmd.exe.

Residual configuration pattern:

"commandline": "cmd.exe /s /k \"%ProgramFiles(x86)%\\Clink\\bin\\clink_x64.exe inject\""

When present, Clink injects into every new terminal tab, bypassing standard PATH lookups and classic AutoRun keys.

3) AppInit_DLLs verification#

To confirm no system-wide DLL injection is active for spawned processes:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs

4) Definitive removal runbook#

4.1 Native Clink uninstallation (if binaries exist)#

If the binary is still on the disk, the supported and cleanest method is:

clink autorun show
clink autorun uninstall

4.2 Manual cleanup of AutoRun keys (if applicable)#

If the uninstaller is missing or residual keys remain:

reg delete "HKCU\Software\Microsoft\Command Processor" /v AutoRun /f
reg delete "HKLM\Software\Microsoft\Command Processor" /v AutoRun /f
reg delete "HKCU\Software\Policies\Microsoft\Windows\Command Processor" /v AutoRun /f
reg delete "HKLM\Software\Policies\Microsoft\Windows\Command Processor" /v AutoRun /f

4.3 Reverting Windows Terminal profile#

• Remove the inject argument from commandline;
• Reset the property to default: "commandline": "cmd.exe".

4.4 Purging orphaned binaries and state files#

Clink maintains binaries under %ProgramFiles(x86)%\Clink and user state data under %LOCALAPPDATA%\clink:

dir /b "%ProgramFiles(x86)%\clink\bin"
del /f /q "%ProgramFiles(x86)%\clink\bin\clink*.chd"
rd /s /q "%ProgramFiles(x86)%\clink"
rd /s /q "%LOCALAPPDATA%\clink"

4.5 Verification with Sysinternals Autoruns#

To confirm total eradication:

• Launch Autoruns as Administrator;
• Review the Logon and AppInit DLLs tabs;
• Filter for clink or inject to verify no remaining hooks.

Infrastructure and security takeaways#

1. Execution implies a trigger: the system PATH is only one of many startup vectors.
2. Policy overrides local configuration: GPO settings in Policies\Command Processor take precedence over local user keys.
3. Shell baseline governance: undocumented local modifications introduce operational risks and automation breakages.
4. Targeted tooling reduces MTTR: Sysinternals Autoruns and targeted registry audits drastically cut incident response times.

See also

Infrastructure Removing a stuck winfsp on Windows: real diagnostics, MSI failures, and forced removal

Infrastructure Why PowerShell fails to detect the new Outlook in Windows (and how to fix it)

Infrastructure How to edit the hosts file in Windows without permission errors

This post is licensed under CC BY-NC.