The way Microsoft Windows parses "Program Files" in the path seems incredible at first: https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities

The way Microsoft Windows parses "Program Files" in the path seems incredible at first: https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vulnerabilities/14464 https://isc.sans.edu/diary/Help+eliminate+unquoted+path+vuln... http://xato.net/hardening/the-programexe-problem/ http://xato.net/hardening/the-programexe-problem/ "The problem is that it doesn't know. It just starts at the beginning and tries finding an executable until it finds a match. So in this case, it will try these files every time you run the command: C:\Program.exe C:\Program Files\Internet.exe C:\Program Files\Internet Explorer\iexplore.exe "You might see where I'm going with this: if you place an executable named program.exe in the root directory, it will probably end up running quite a bit. In fact, it will run anytime Windows launches a Program Files executable that does not have quotes around the path." [1] [1] http://www.securityfocus.com/columnists/301 http://www.securityfocus.com/columnists/301