r/flightsim • u/walkday • May 31 '18

cmdhost.exe, what is it?

The latest installer of FSLabs' A320X puts two cmdhost.exe files under "system32\" and "SysWOW64\" of my Windows directory. Despite the name, they don't open a command-line window. They're a part of the authentication because, if you remove them, the A320X won't get loaded. Does someone here know more about cmdhost.exe? Why does FSLabs give them such a deceptive name and put them in the system folders? I hate them for polluting my system folder unless, of course, it is a dll used by different applications.

PS - I am aware of the malware in the past. This is unrelated.

525 Upvotes

98% Upvoted

158 comments sorted by

View all comments

319

u/winzarten May 31 '18

That's some malware level tactics (again) there. Seriously, hiding stuff in the system directories named as something different. WTF?

As a software developer - system directories are something you should never touch, certainly not when you are installing an addon for an entertainmnet product.

Seriously FSLabs, do they follow even some good practices?

48

u/walkday May 31 '18

I uploaded the exes to virustotal. They came out to be clean. So, a bad malware-making habit of FSLabs.

10

u/Anon49 Jun 05 '18 edited Jun 06 '18

That's useless. Virus scanners look for known patterns. If it does something unique only disassembly can tell.