p0w3rsh3ll/AutoRuns

ImagePath is wrong for schelued task SA3

p0w3rsh3ll opened this issue · 0 comments

Steps to reproduce

 Get-PSAutorun -ScheduledTasks | ? { $_.value -match "conexant" }
Path          : C:\WINDOWS\system32\Tasks\Microsoft\Windows\Conexant\SA3
Item          : SA3
Category      : Task
Value         : "C:\Program Files\CONEXANT\SA3\HP-NB-AIO\SACpl.exe" /sa3 /nv:3.0+ /uid:HP-NB-AIO /s /dne
ImagePath     : C:\Program Files\CONEXANT\SA3\HP-NB-AIO\SACpl.exe" \sa3 \nv:3.0

Expected behavior

Get rid of what appears behind .exe

Get-PSAutorun -ScheduledTasks | ? { $_.value -match "conexant" }
Path          : C:\WINDOWS\system32\Tasks\Microsoft\Windows\Conexant\SA3
Item          : SA3
Category      : Task
Value         : "C:\Program Files\CONEXANT\SA3\HP-NB-AIO\SACpl.exe" /sa3 /nv:3.0+ /uid:HP-NB-AIO /s /dne
ImagePath     : C:\Program Files\CONEXANT\SA3\HP-NB-AIO\SACpl.exe

Environment data

> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.18362.145
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.18362.145
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1