{"id":4184,"date":"2017-11-05T01:16:00","date_gmt":"2017-11-05T00:16:00","guid":{"rendered":"http:\/\/borncity.com\/win\/?p=4184"},"modified":"2021-06-17T23:03:27","modified_gmt":"2021-06-17T21:03:27","slug":"windows-what-is-remsh-exe-for","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2017\/11\/05\/windows-what-is-remsh-exe-for\/","title":{"rendered":"Windows 10: What is REMSH.exe for?"},"content":{"rendered":"

[German<\/a>]Recently I stumbled over a question in a German forum, asking, what the file REMSH.exe<\/em> is for. Here are a few information I found, after I investigated this question.<\/p>\n

<\/p>\n

The first case, I've seen<\/h2>\n

\"\"The first time I stumbled within this German forum discussion about the program file REMSH.exe<\/em> and the question what this file is for. A user wrote:<\/p>\n

Firewall reports since a few weeks ago that REMSH. exe wants to connect to MS<\/p>\n

Since some time I'm receiving firewall alerts, that the file remsh. exe wants to use the path C: \\Program Files\\rempl\\ to establish a connection to an IP which, according to the IP address of the server query belongs to Microsoft Corporation, or more precisely to Microsoft Azure.<\/p>\n

Can someone tell me what this file wants to do and where it comes from? All affected computers are Windows 10 Pro with Commodo Firewall 10.<\/p><\/blockquote>\n

Browsing the Internet doesn't seems to help at a first glance. The first MS Answers forum entry<\/a> I found, claimed (faulty) it was malware.<\/p>\n

What is remsh.exe?<\/p>\n

remsh.exe (C:\\Program Files\\rempl\\remsh.exe) try to access the Internet these days<\/p>\n

remsh.exe is signed by Microsoft. It also has high CPU usage and disk writing sometimes.<\/p>\n

What is remsh.exe? What is it for?<\/p><\/blockquote>\n

Also this Microsoft Answers forum thread<\/a> seems to walk in the same direction \u2013 note the answer of the Microsoft employee. And here<\/a> we have a discussion, that Rempl <\/em>triggers a daily task.<\/p>\n

Could REMSH.exe be malware?<\/h2>\n

The first question to check would be: Is remsh.exe<\/em> malware or something from Microsoft. Checking several forum entries, I found out, that the file is located within the path:<\/p>\n

C:\\Program Files\\rempl\\<\/em><\/p>\n

as mentioned above. And what the user cited above wrote, was, that he program tries to connect a Microsoft Azure server. So it seems, that the program is legit. But checking some test machines with Windows 10, I wasn't able to detect this file. This triggers 'worse fears' that it could be malware.<\/p>\n

\"REMSH.exe\"<\/p>\n

The best you can do in such a case: Right click the file, select Properties <\/em>and check the Digital Signatures<\/em> property page. Here<\/a> I found a user, who has posted the screen shown above. The file has been digitally signed by Microsoft, so it's not malware.<\/p>\n

What you also should do: Upload the file to Virus Total<\/a> and let it check for malware.<\/p><\/blockquote>\n

But what is REMSH.exe?<\/h2>\n

The remaining question is: Why is REMSH.exe<\/em> available only on some machine and is there an explanation, what the file is for? Searching the web for the file name brought me to Microsoft's KB article 4023057<\/a> that gives us some clue. At the time this blog post was written, KB4023057 stands for Update to Windows 10 Versions 1507, 1511, and 1607 for update reliability: November 2, 2017<\/em>. Microsoft says:<\/p>\n

This update includes reliability improvements that affect the update components in Windows 10 Versions 1507, 1511, and 1607.<\/p>\n

This update includes files and resources that address issues that affect the update processes in Windows 10. These improvements ensure that quality updates are installed seamlessly to improve the reliability and security of Windows 10.<\/p>\n

Only certain builds of Windows 10 Versions 1507, 1511, and 1607 require this update. Devices that are running those builds will automatically get the update downloaded and installed through Windows Update.<\/p><\/blockquote>\n

And there I found a mention of Remsh.exe<\/em>:<\/p>\n\n\n\n\n
File name<\/strong><\/td>\nFile version<\/strong><\/td>\nFile size<\/strong><\/td>\nDate<\/strong><\/td>\nTime<\/strong><\/td>\n<\/tr>\n
Remsh.exe<\/td>\n10.0.14393.1273<\/td>\n707,064<\/td>\n29-Sep-2017<\/td>\n03:28<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The file version given in the table above may vary. But we have a firm explanation for our questions. First of all, the file may be found on 'certain builds of Windows 10 Versions 1507, 1511, and 1607 [that] require this update'. And it address issues that affect the update processes in Windows 10. Hope this has shed some light into this topic.<\/p>\n

Addendum: Parts of the remsh.exe<\/em> has been replanced, see also my remarks within the blog post\u00a0Windows 10: update KB4023057 released (Sept. 6, 2018)<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

[German]Recently I stumbled over a question in a German forum, asking, what the file REMSH.exe is for. Here are a few information I found, after I investigated this question.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[1130,194],"class_list":["post-4184","post","type-post","status-publish","format-standard","hentry","category-windows","tag-remsh-exe","tag-windows"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/4184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=4184"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/4184\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=4184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=4184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=4184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}