Question

I’ve written a .net 4.0 framework app (in VB.net). It’s a simple thing really, basically just a screensaver with a few bells and whistles.

It DOES use the webclient functions of .net to make queries to various sites on the internet, however.

But it IS NOT a web application. It doesn’t run under ASP, or, as far as I can tell, have ANYTHING to do with ASP.net.

However, when I run it on a machine with Comodo Firewall installed, I get warning popups from Comodo indicating that

1) the program is trying to access the internet (this is a good thing, no problem here).

but

2) That the program is trying to create registry keys like:
hklm\system\controlset001\services\asp.net_4.0.30319\names{somelonghexvalue}

Now, I’ve always followed the rule that basically the only things that muck around in HKLM are installers, but here this app is trying to do something in there. And it’s coming from the .net framework, my app isn’t requesting any key at all from the registry.

I’m guessing that it’s something that the framework has been given permission to do, even if the current user would not have rights to create keys in HKLM (since I get no errors, even when the app runs under credentials with very few rights).

So, my question is, anyone run into this before, or have any idea as to why the framework would be creating ASP.Net reg keys when running a standard EXE that doesn’t have anything to do with ASP.net?

I did turn up this question,
ASP.NET 4 registry changes
but the asker in that case was actually dealing with ASP.net applications. In this case, I’m not.

–EDIT–
Added the code used to perform the HTTP Get, for Clara

Dim request As HttpWebRequest = DirectCast(WebRequest.Create(requestUri), HttpWebRequest)
Dim resultPage As String = String.Empty
Using httpWebResponse As HttpWebResponse = DirectCast(request.GetResponse(), HttpWebResponse)
    Using responseStream As Stream = httpWebResponse.GetResponseStream()
        Using reader As New StreamReader(responseStream)
            resultPage = reader.ReadToEnd()
        End Using
    End Using
End Using

Answer 1

It’s updating the ASP.NET performance counters for some reason, although I’m not sure why.

That registry key stores the named pipe name for ASP.NET:

Pipe names. One per each running worker process. See “What happens at
runtime?”. This sub-key appears only on the 32 bit versioned keys.

…

During runtime, whenever a web application is run and the worker
process starts, it loads webengine.dll (or webengine4.dll in .Net
4.0). This library, among other many things, will initialize the performance counters local storage in the process. It will also create
a named pipe to which clients will be able to connect and read the
counters data from. The name of the pipe is stored in the
HKLM\SYSTEM\CurrentControlSet\services\ASP.NET_x.x.xxxxx\Names
registry key, so clients can find it.

The processing of the named pipe is asynchronous. The library uses an
IO completion thread from the CLR, which wakes up every time

References:

ASP.NET Internals – Performance counters implementation details