Autoruns path resolution issue for scheduled tasks with a space in the file path RRS feed

  • Question

  • I came across a path edge case that Autoruns fails to resolve (tested with 13.94). 

    When schtasks is used to create a task with a space in the file path and the file path is not double quoted, the path is split into a command and argument.

    For example:

    schtasks /CREATE /TN space /TR "c:\users\first last\write.exe" /SC onlogon

    Creates a task that looks like:

    Command: "c:\users\first"
    Arguments: "last\write.exe"

    When Windows executes the task, it puts the command and arguments back together and runs "c:\users\first last\write.exe".

    For scheduled tasks, Autoruns appears to only use the command for the Image Path so it shows a "file not found" error.

    I can't post images here because my account isn't verified. But a full write-up with screenshots can be found here:

    • Edited by jdferrell Friday, May 3, 2019 7:46 PM
    Wednesday, April 17, 2019 3:35 AM