Update with remsh.exe seems suspicious

Yesterday C:\Program Files\rempl\remsh.exe tried to access the Internet on my Win10 machine.

After a quick investigation it may came in with the Windows update according to Article ID: 4023057 - Last Review: Sep 28, 2017 - Revision: 46 (https://support.microsoft.com/en-us/help/4023057/update-to-windows-10-versions-1507-1511-and-1607-for-update-reliabilit).

It makes me a bit nervous that my file attributes (version, size, etc.) are different and these are nowhere else mentioned (according Google):

File name File version File size Date Time
Remsh.exe 10.0.14393.1262 644 KB 03-Sep-2017 19:44

Where can I check if this is really a Microsoft SW?

Microsoft signature seems to be valid and virus scanner keeps quiet...

Thanks in advance for any hint!


Let me just clarify that the remsh.exe is believed to be a possible malware and could be used by phishers if it does not come along a certain KB update. If the file has been received along with a KB update specifically if it’s through automatic update process, the file should be safe and is part of improving Windows 10 via updates.


If you have other queries, don’t hesitate to reply.

8 people found this reply helpful


Was this reply helpful?

Sorry this didn't help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.


Question Info

Last updated June 22, 2020 Views 6,819 Applies to: