a flag in the windows registry identifies a clsid as unsafe. the clsid (a type of a guid) acts as a serial number for the software in question. it must exist for each piece of software that behaves as an activex control. if an activex container finds that the clsid of a killbit entry matches the clsid of the software, the software is blocked from running in the activex container. if a vendor wants to release an updated version then they release it with a different clsid.