Update with remsh.exe seems suspicious

Yesterday C:\Program Files\rempl\remsh.exe tried to access the Internet on my Win10 machine.

After a quick investigation it may came in with the Windows update according to Article ID: 4023057 - Last Review: Sep 28, 2017 - Revision: 46 (https://support.microsoft.com/en-us/help/4023057/update-to-windows-10-versions-1507-1511-and-1607-for-update-reliabilit).

It makes me a bit nervous that my file attributes (version, size, etc.) are different and these are nowhere else mentioned (according Google):

File name File version File size Date Time
Remsh.exe 10.0.14393.1262 644 KB 03-Sep-2017 19:44

Where can I check if this is really a Microsoft SW?

Microsoft signature seems to be valid and virus scanner keeps quiet...

Thanks in advance for any hint!


Let me just clarify that the remsh.exe is believed to be a possible malware and could be used by phishers if it does not come along a certain KB update. If the file has been received along with a KB update specifically if it’s through automatic update process, the file should be safe and is part of improving Windows 10 via updates.


If you have other queries, don’t hesitate to reply.

8 people were helped by this reply


Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.


Question Info

Last updated June 22, 2020 Views 6,805 Applies to: