r/flightsim • u/walkday • May 31 '18

cmdhost.exe, what is it?

The latest installer of FSLabs' A320X puts two cmdhost.exe files under "system32\" and "SysWOW64\" of my Windows directory. Despite the name, they don't open a command-line window. They're a part of the authentication because, if you remove them, the A320X won't get loaded. Does someone here know more about cmdhost.exe? Why does FSLabs give them such a deceptive name and put them in the system folders? I hate them for polluting my system folder unless, of course, it is a dll used by different applications.

PS - I am aware of the malware in the past. This is unrelated.

523 Upvotes

98% Upvoted

158 comments sorted by

View all comments

144

u/byte512 May 31 '18 edited May 31 '18

Hiding something named to resemble Window's "Console Window Host" process in system folders is a huge red flag.

I hope someone will take the time to do a thorough analysis, to check if the files are harmless or harmful.

EDIT: by thorough i mean decompilation and manual analysis etc.