{"record":{"id":"238de75037004159","repo":"shadow1ng/fscan","slug":"local-pe-not-found-238de7","errorCode":null,"errorMessage":"local_pe_not_found","messagePattern":"local_pe_not_found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/winschtask.go","lineNumber":34,"sourceCode":")\n\ntype WinSchTaskPlugin struct {\n\tplugins.BasePlugin\n}\n\nfunc NewWinSchTaskPlugin() *WinSchTaskPlugin {\n\treturn &WinSchTaskPlugin{\n\t\tBasePlugin: plugins.NewBasePlugin(\"winschtask\"),\n\t}\n}\n\nfunc (p *WinSchTaskPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {\n\tpePath := session.Config.WinPEFile\n\tif pePath == \"\" {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.GetText(\"local_pe_not_specified\"))}\n\t}\n\tif _, err := os.Stat(pePath); err != nil {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.Tr(\"local_pe_not_found\", pePath))}\n\t}\n\text := strings.ToLower(filepath.Ext(pePath))\n\tif ext != \".exe\" && ext != \".dll\" {\n\t\treturn &plugins.Result{Success: false, Error: fmt.Errorf(\"%s\", i18n.Tr(\"local_invalid_pe\", pePath))}\n\t}\n\n\tabsPath, _ := filepath.Abs(pePath)\n\tbaseName := strings.TrimSuffix(filepath.Base(absPath), filepath.Ext(absPath))\n\n\ttasks := []struct {\n\t\tname     string\n\t\tschedule string\n\t\tmodifier string\n\t}{\n\t\t{fmt.Sprintf(\"WindowsUpdateCheck_%s\", baseName), \"DAILY\", \"1\"},\n\t\t{fmt.Sprintf(\"SystemSecurityScan_%s\", baseName), \"ONLOGON\", \"\"},\n\t\t{fmt.Sprintf(\"MaintenanceTask_%s\", baseName), \"ONSTART\", \"\"},\n\t\t{fmt.Sprintf(\"BackgroundService_%s\", baseName), \"HOURLY\", \"2\"},","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/winschtask.go#L16-L52","documentation":"WinSchTaskPlugin.Scan verifies that the configured local PE file exists by calling os.Stat on session.Config.WinPEFile. When Stat returns an error, the plugin aborts with this localized 'local PE not found' message containing the path. No scheduled-task comparison is performed.","triggerScenarios":"Config.WinPEFile is set but the file cannot be stat'ed: non-existent path, wrong relative base directory, deleted sample, or a permission/filesystem error on the path.","commonSituations":"Path typo; running from a different working directory than the one where the PE file resides; antivirus quarantined or removed the sample between configuration and scan; UNC/network path unavailable.","solutions":["Confirm the file exists at the configured path and fix the path in Config.WinPEFile.","Switch to an absolute path independent of CWD.","Check filesystem/AV interference and restore or whitelist the file.","Verify drive/UNC availability if the path is on a share."],"exampleFix":"// before\nsession.Config.WinPEFile = \"C:\\\\samples\\\\agent.exe\" // file was quarantined\n// after\nif _, err := os.Stat(session.Config.WinPEFile); err != nil {\n    log.Fatalf(\"PE file missing: %v\", err)\n}\np.Scan(ctx, host, session)","handlingStrategy":"validation","validationCode":"if info, err := os.Stat(cfg.WinPEFile); err != nil || info.IsDir() {\n    return fmt.Errorf(\"invalid PE path %q\", cfg.WinPEFile)\n}","typeGuard":null,"tryCatchPattern":"res := plugin.Scan(ctx, host, session)\nif !res.Success && strings.Contains(res.Error.Error(), \"not found\") {\n    log.Warnf(\"skipping schtask check: %v\", res.Error)\n}","preventionTips":["Verify the sample still exists at scan time (AV may remove it).","Resolve relative paths to absolute at config-load time.","Prefer copying the sample to a tool-controlled temp dir with known permissions."],"tags":["file-not-found","windows","scheduled-tasks","pe-file"],"backgroundTag":"file-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}