Fake RegAsm Process

[lout]

This exact thing happened to me on this exact date in June but with a different generated file name in the same exact folder location. Files attached.  I had to do the same thing, screen record to get the path. Nothing was there. Found the path and tried to remove it. No luck. Same issue in the task scheduler and had to delete it. Nothing picked this crap up. Not Avira, MalwareByets, Spybot S&D, Cyberghost, or Avast. The craziest part is that these files are generating an officially signed Microsoft certificate.  Here is some text from inside the file. Seems as though it's trying to assemble itself and callback somewhere remotely with a digitally signed connection. (Which can be generated easily for $100 by any signing authority)

 

RegAsm.exe   Microsoft Corporation   Microsoft® .NET Framework  4 /© Microsoft Corporation.  All rights reserved.   
4.8.4084.0   4.0.0.0  
 en-US  * %f:\dd\tools\devdiv\FinalPublicKey.snk  ƒH ‚@002400000c800000140100000602000000240000525341310008000001000100613399aff18ef1a2c2514a273a42d9042b72321f1757102df9ebada69923e2738406c21e5b801552ab8d200a65a235e001ac9adc25f2d811eb09496a4c6a59d4619589c69f5baf0c4179a47311d92555cd006acc8b5959f2bd6e10e360c34537a1d266da8085856583c85d81da7f3ec01ed9564c58d93d713cd0172c8e23a10f0239b80c96b07736f5d8b022542a4e74251a5f432824318b3539a5a087f8e53d2f135f9ca47f3bb2e10aff0af0849504fb7cea3ff192dc8de0edad64c68efde34c56d302ad55fd6e80f302d5efcdeae953658d3452561b5f36c542efdbdd9f888538d374cef106acf7d93a4445c3c73cd911f0571aaf3d54da12b11ddec375b3 a5a866e1ee186f807668209f3b11236ace5e21f117803a3143abb126dd035d7d2f876b6938aaf2ee3414d5420d753621400db44a49c486ce134300a2106adb6bdb433590fef8ad5c43cba82290dc49530effd86523d9483c00f458af46890036b0e2c61d077d7fbac467a506eba29e467a87198b053c749aa2a4d2840c784e6d    TWrapNonExceptionThrows     ) $00020406-0000-0000-C000-000000000046        {  ÎÊï¾   ‘   lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet   5       PADPADPS~¢ƒ’¥ƒF܆[¾‡Ø®ÞŠÙ®ÞŠÚ®ÞŠÛ®ÞŠ0¯ÞŠ1¯ÞŠ8¯ÞŠ9¯ÞŠ:¯ÞŠ;¯ÞŠ<¯ÞŠ=¯ÞŠ>¯ÞŠ?¯ÞŠ€x¡©^š\jÑ›­…B×R¡Gq·è
¸Ê0Ë»lCÐÅIۼȹ²…Ñý7ÔB 
Ý£ôÇÞÃÉáô”ç öè¢)ùÎÍÏ ±çð÷igËÿÃá?@" ñé&ÞÞ>-5²S2¶ß	7À’DÕQSPÉâôSÐàÛYq3"rcñ{„HÇø  x  )  ‡  Ø  õ    /  »  ž  Ó  ¶  
  ð  G  *    d  è   .  ¡  0  í  …  ¥  ¶  Ö  ý  W  [  ”  >  t     ,	  ~  Ì  Å  «       )   È  L  '  C  \  n  ‰      ý  Ÿ  Ø  »  $E r r _ A m b i g o u s O p t i o n     FE r r _ A s m P a t h C a n O n l y B e U s e d W i t h R e g F i l e    2E r r _ C a n n o t C r e a t e A p p D o m a i n t   8E r r _ C a n n o t C r e a t e R e m o t e R e g A s m ®   :E r r _ C a n n o t G e n R e g F i l e A n d E x p T l b ù   BE r r _ C a n n o t G e n R e g F i l e F o r U n r e g i s t e r 2  2E r r _ C a n n o t W r i t e T o R e g i s t r y r  ,E r r _ E r r o r I n U s e r D e f F u n c A  *E r r _ I n p u t F i l e N o t F o u n d Œ  &E r r _ I n v a l i d A s s e m b l y Ï  "E r r _ I n v a l i d O p t i o n 
  "E r r _ N o A s m C o d e B a s e 3  E r r _ N o I n p u t F i l e a  &E r r _ N o V a l u e R e q u i r e d ƒ  ,E r r _ R e f A s m N o t I n A s m P a t h ­  <E r r _ R e g F i l e W o u l d O v e r w r i t e I n p u t   BE r r _ T l b N a m e N o t A l l o w e d W i t h E m b e d d e d G  ,E r r _ T y p e L o a d E x c e p t i o n s «  2E r r _ T y p e l i b R e g i s t e r F a i l e d ü  *E r r _ T y p e l i b S a v e F a i l e d =  "E r r _ U n k n o w n O p t i o n y  0E r r _ U n r e g i s t r a t i o n F a i l e d   "E r r _ V a l u e R e q u i r e d Ê  4M s g _ A s s e m b l y E x p o r t e d A n d R e g ì  2M s g _ A u t o E x p A n d R e g A s s e m b l y :  M s g _ C o p y r i g h t Z  (M s g _ D i s p l a y E x c e p t i o n   4M s g _ D i s p l a y N e s t e d E x c e p t i o n   ,M s g _ E m b e d d e d T y p e l i b R e g 6  .M s g _ R e f A s m R e s o l v e d T o A s m y  ,M s g _ R e g S c r i p t G e n e r a t e d Ù  .M s g _ T y p e l i b U n r e g i s t e r e d   &M s g _ T y p e s R e g i s t e r e d 6  *M s g _ T y p e s U n R e g i s t e r e d U  M s g _ U s a g e _ 0 0 w  M s g _ U s a g e _ 0 1 ¨  M s g _ U s a g e _ 0 2 Ó  M s g _ U s a g e _ 0 3 	  M s g _ U s a g e _ 0 4 I	  M s g _ U s a g e _ 0 5 	  M s g _ U s a g e _ 0 6 ×	  M s g _ U s a g e _ 0 7 
  M s g _ U s a g e _ 0 8 X
  M s g _ U s a g e _ 0 9 ¢
  M s g _ U s a g e _ 1 0 Þ
  M s g _ U s a g e _ 1 1   M s g _ U s a g e _ 1 2 l  M s g _ U s a g e _ 1 3 ¡  8W r n _ C o d e B a s e W i t h N o S t r o n g N a m e Ö  :W r n _ C o m T y p e l i b N o t U n r e g i s t e r e d ö  0W r n _ N o R e g S c r i p t G e n e r a t e d ?
  *W r n _ N o T y p e s R e g i s t e r e d ‰
  .W r n _ N o T y p e s U n R e g i s t e r e d £
  Ambiguous option: /{0}ZThe /asmpath option is only supported when generating a reg file using the /regfile option8Error creating an app domain to perform the registrationIUnable to load the RemoteRegAsm type required to perform the registration7The /regfile option cannot be used with the /tlb option>The /regfile option cannot be used with the /unregister optionÌAn error occurred while writing the registration information to the registry. Administrator permissions are needed to use the selected options. Use an administrator command prompt to complete these tasks.IAn error occurred inside the user defined Register/Unregister functions: AUnable to locate input assembly '{0}' or one of its dependencies.<Failed to load '{0}' because it is not a valid .NET assembly$An invalid option has been specified,The assembly '{0}' does not have a code base No input file has been specified(The /{0} option does not require a valuejThe following referenced assembly could not be located in any of the locations specified via /asmpath: {0},Registry file would overwrite the input filebThe name of the type library cannot be specified for assemblies containing embedded type librariesOThe following exceptions were thrown while loading the types in the assembly:
?An error occurred while registering the exported type library: :An error occurred while saving the exported type library: Unknown option: /{0}9An error occurred while un-registering the type library:  The /{0} option requires a valueLAssembly exported to '{0}', and the type library was registered successfullyAuto exporting '{0}' as '{1}'.ªMicrosoft .NET Framework Assembly Registration Utility version {0}
for Microsoft .NET Framework version {0}
Copyright (C) Microsoft Corporation.  All rights reserved.
Exception[{0}] = {1}Exception[{0}] ==>> {1}AType library embedded in '{0}' loaded and registered successfully^Assembly reference '{0}' has been resolved to assembly '{1}' with the following code base: {2},Registry script '{0}' generated successfully-Type library '{0}' un-registered successfullyTypes registered successfully Types un-registered successfully/Syntax: RegAsm AssemblyName [Options]
Options:)    /unregister          Unregister typesJ    /tlb[:FileName]      Export the assembly to the specified type library(                         and register itD    /regfile[:FileName]  Generate a reg file with the specified nameF                         instead of registering the types. This optionC                         cannot be used with the /u or /tlb options:    /codebase            Set the code base in the registryH    /registered          Only refer to already registered type libraries:    /asmpath:Directory   Look for assembly references here=    /nologo              Prevents RegAsm from displaying logoM    /silent              Silent mode. Prevents displaying of success messages3    /verbose             Displays extra information3    /? or /help          Display this usage messageRegistering an unsigned assembly with /codebase can cause your assembly to interfere with other applications that may be installed on the same computer. The /codebase switch is intended to be used only with signed assemblies. Please give your assembly a strong name and re-register it.GType library not un-registered since the assembly was imported from COMHNo registry script will be produced since there are no types to registerNo types were registeredNo types were un-registered §~pH…OÆæÅ7vEØÓzª(žá²96åÉ$ül§¾ôúÕNÆ•«‹å›ÃJ®ó’ø¤ÓDl0‰h¡Èl‡¦|M›†}œŸå®÷ÂÂ~€s“Ÿ EX§ÇšÍ„ÓÚÑÎÁ¨Ž~ÃàÒWt!À<«DôúTN§x<nIǪ9ŽÙ~E	±(#£…‘ÉŠGî\RëCø÷øaggMú™…†8ù±ÉêúãÓ;è9‚/$Φ"²8—DçÎx΃1ŽŠ»=Ê5ÝCb—5ˆñ8†gˆ7§á:<ýžaˆ°àê)Ùº¬Ù[üD…içÈÚìÚ@•‹CÜ3!ªD    È<Ú]       #   ðÌ  ð®  RSDSä« çRdH’MN‹Ël€   RegAsm.pdb                                                                                                                                                           	    à              4   V S _ V E R S I O N _ I N F O     ½ïþ       ô     ov?                        ^   S t r i n g F i l e I n f o   :   0 4 0 9 0 4 B 0   L   C o m p a n y N a m e     M i c r o s o f t   C o r p o r a t i o n   ‚ -  F i l e D e s c r i p t i o n     M i c r o s o f t   . N E T   A s s e m b l y   R e g i s t r a t i o n   U t i l i t y     ^   F i l e V e r s i o n     4 . 8 . 4 0 8 4 . 0   b u i l t   b y :   N E T 4 8 R E L 1     6   I n t e r n a l N a m e   R e g A s m . e x e     ‚ /  L e g a l C o p y r i g h t   ©   M i c r o s o f t   C o r p o r a t i o n .     A l l   r i g h t s   r e s e r v e d .     >   O r i g i n a l F i l e n a m e   R e g A s m . e x e     T   P r o d u c t N a m e     M i c r o s o f t ®   . N E T   F r a m e w o r k   :   P r o d u c t V e r s i o n   4 . 8 . 4 0 8 4 . 0     4   C o m m e n t s   F l a v o r = R e t a i l   2 	  P r i v a t e B u i l d   D D B L D 5 0 2     D    V a r F i l e I n f o     $    T r a n s l a t i o n     	° ä  ”          <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> 
      <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> 
        <security> 
          <requestedPrivileges> 
            <requestedExecutionLevel 
              level="asInvoker" 
              uiAccess="false"/> 
          </requestedPrivileges> 
        </security> 
      </trustInfo> 
      <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"> 
        <application> 
          <!-- Windows Vista and Server 2008 --> 
           
          <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" /> 
          <!-- Windows 7 and Server 2008 R2 --> 
           
          <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" /> 
          <!-- Windows 8 and Server 2012 --> 
          <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" /> 
          <!-- Windows 8.1 (Blue) and Server 2012 R2--> 
           
          <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" /> 
          <!-- Windows Threshold  --> 
           
          <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" /> 
        </application> 
      </compatibility> 
    </assembly>                                                                                                                                                                                                             À     `>                                                                                                                                                                                                                                                                                                                                               	’&‰“ò,d	microsoft1-0+U$Microsoft Root Certificate Authority0
070403125309Z
210403130309Z0w10	UUS10U
Washington10URedmond10U
Microsoft Corporation1!0UMicrosoft Time-Stamp PCA0‚"0

B e U s e d W i t h R e g F i l e    2E r r _ C a n n o t C r e a t e A p p D o m a i n t   8E r r _ C a n n o t C r e a t e R e m o t e R e g A s m ®   :E r r _ C a n n o t G e n R e g F i l e A n d E x p T l b ù   BE r r _ C a n n o t G e n R e g F i l e F o r U n r e g i s t e r 2  2E r r _ C a n n o t W r i t e T o R e g i s t r y r  ,E r r _ E r r o r I n U s e r D e f F u n c A  *E r r _ I n p u t F i l e N o t F o u n d Œ  &E r r _ I n v a l i d A s s e m b l y Ï  "E r r _ I n v a l i d O p t i o n 
  "E r r _ N o A s m C o d e B a s e 3  E r r _ N o I n p u t F i l e a  &E r r _ N o V a l u e R e q u i r e d ƒ  ,E r r _ R e f A s m N o t I n A s m P a t h ­  <E r r _ R e g F i l e W o u l d O v e r w r i t e I n p u t   BE r r _ T l b N a m e N o t A l l o w e d W i t h E m b e d d e d G  ,E r r _ T y p e L o a d E x c e p t i o n s «  2E r r _ T y p e l i b R e g i s t e r F a i l e d ü  *E r r _ T y p e l i b S a v e F a i l e d =  "E r r _ U n k n o w n O p t i o n y  0E r r _ U n r e g i s t r a t i o n F a i l e d   "E r r _ V a l u e R e q u i r e d Ê  4M s g _ A s s e m b l y E x p o r t e d A n d R e g ì  2M s g _ A u t o E x p A n d R e g A s s e m b l y :  M s g _ C o p y r i g h t Z  (M s g _ D i s p l a y E x c e p t i o n   4M s g _ D i s p l a y N e s t e d E x c e p t i o n   ,M s g _ E m b e d d e d T y p e l i b R e g 6  .M s g _ R e f A s m R e s o l v e d T o A s m y  ,M s g _ R e g S c r i p t G e n e r a t e d Ù  .M s g _ T y p e l i b U n r e g i s t e r e d   &M s g _ T y p e s R e g i s t e r e d 6  *M s g _ T y p e s U n R e g i s t e r e d U  M s g _ U s a g e _ 0 0 w  M s g _ U s a g e _ 0 1 ¨  M s g _ U s a g e _ 0 2 Ó  M s g _ U s a g e _ 0 3 	  M s g _ U s a g e _ 0 4 I	  M s g _ U s a g e _ 0 5 	  M s g _ U s a g e _ 0 6 ×	  M s g _ U s a g e _ 0 7 
  M s g _ U s a g e _ 0 8 X
  M s g _ U s a g e _ 0 9 ¢
  M s g _ U s a g e _ 1 0 Þ
  M s g _ U s a g e _ 1 1   M s g _ U s a g e _ 1 2 l  M s g _ U s a g e _ 1 3 ¡  8W r n _ C o d e B a s e W i t h N o S t r o n g N a m e Ö  :W r n _ C o m T y p e l i b N o t U n r e g i s t e r e d ö  0W r n _ N o R e g S c r i p t G e n e r a t e d ?
  *W r n _ N o T y p e s R e g i s t e r e d ‰
  .W r n _ N o T y p e s U n R e g i s t e r e d £
  Ambiguous option: /{0}ZThe /asmpath option is only supported when generating a reg file using the /regfile option8Error creating an app domain to perform the registrationIUnable to load the RemoteRegAsm type required to perform the registration7The /regfile option cannot be used with the /tlb option>The /regfile option cannot be used with the /unregister optionÌAn error occurred while writing the registration information to the registry. Administrator permissions are needed to use the selected options. Use an administrator command prompt to complete these tasks.IAn error occurred inside the user defined Register/Unregister functions: AUnable to locate input assembly '{0}' or one of its dependencies.<Failed to load '{0}' because it is not a valid .NET assembly$An invalid option has been specified,The assembly '{0}' does not have a code base No input file has been specified(The /{0} option does not require a valuejThe following referenced assembly could not be located in any of the locations specified via /asmpath: {0},Registry file would overwrite the input filebThe name of the type library cannot be specified for assemblies containing embedded type librariesOThe following exceptions were thrown while loading the types in the assembly:
?An error occurred while registering the exported type library: :An error occurred while saving the exported type library: Unknown option: /{0}9An error occurred while un-registering the type library:  The /{0} option requires a valueLAssembly exported to '{0}', and the type library was registered successfullyAuto exporting '{0}' as '{1}'.ªMicrosoft .NET Framework Assembly Registration Utility version {0}
for Microsoft .NET Framework version {0}
Copyright (C) Microsoft Corporation.  All rights reserved.
Exception[{0}] = {1}Exception[{0}] ==>> {1}AType library embedded in '{0}' loaded and registered successfully^Assembly reference '{0}' has been resolved to assembly '{1}' with the following code base: {2},Registry script '{0}' generated successfully-Type library '{0}' un-registered successfullyTypes registered successfully Types un-registered successfully/Syntax: RegAsm AssemblyName [Options]
Options:)    /unregister          Unregister typesJ    /tlb[:FileName]      Export the assembly to the specified type library(                         and register itD    /regfile[:FileName]  Generate a reg file with the specified nameF                         instead of registering the types. This optionC                         cannot be used with the /u or /tlb options:    /codebase            Set the code base in the registryH    /registered          Only refer to already registered type libraries:    /asmpath:Directory   Look for assembly references here=    /nologo              Prevents RegAsm from displaying logoM    /silent              Silent mode. Prevents displaying of success messages3    /verbose             Displays extra information3    /? or /help          Display this usage messageRegistering an unsigned assembly with /codebase can cause your assembly to interfere with other applications that may be installed on the same computer. The /codebase switch is intended to be used only with signed assemblies. Please give your assembly a strong name and re-register it.GType library not un-registered since the assembly was imported from COMHNo registry script will be produced since there are no types to registerNo types were registeredNo types were un-registered §~pH…OÆæÅ7vEØÓzª(žá²96åÉ$ül§¾ôúÕNÆ•«‹å›ÃJ®ó’ø¤ÓDl0‰h¡Èl‡¦|M›†}œŸå®÷ÂÂ~€s“Ÿ EX§ÇšÍ„ÓÚÑÎÁ¨Ž~ÃàÒWt!À<«DôúTN§x<nIǪ9ŽÙ~E	±(#£…‘ÉŠGî\RëCø÷øaggMú™…†8ù±ÉêúãÓ;è9‚/$Φ"²8—DçÎx΃1ŽŠ»=Ê5ÝCb—5ˆñ8†gˆ7§á:<ýžaˆ°àê)Ùº¬Ù[üD…içÈÚìÚ@•‹CÜ3!ªD    È<Ú]       #   ðÌ  ð®  RSDSä« çRdH’MN‹Ël€   RegAsm.pdb   

 

gufgwrc.zip

[lout]

@viperg https://techdows.com/2020/04/what-is-firefox-default-browser-agent-and-how-to-disable-it.html

Maybe it actually is Mozilla since their update and the most recent one broke something and they aren't using the callback correctly?

[lout]

The ephemeral window that pops up every few minutes. 

[AdvancedSetup]

Hello @lout

Let me have you run the following and I'll check back on you again tomorrow.

 

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler

 

 

 

 

 

Spoiler

 

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

 

 

STEP 01

• If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Double-click to run the program
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
• Please attach the Additions.txt log to your reply as well.
• On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks