Thread: SCR attack
View Single Post
  #15  
Old December 3rd 19, 09:55 AM posted to alt.comp.os.windows-10,alt.windows7.general
VanguardLH[_2_]
external usenet poster
 
Posts: 10,881
Default SCR attack

JJ wrote:

remove the SCR file association


Run "assoc .scr" in a command shell. Should point at the 'scrfile'
handler. In the registry, it's the following key:

HKEY_CLASSES_ROOT\scrfile

under which the shell - open - command key says to load using:

"%1" /S

That means the .scr file is handled like an executable, passing the
program to the command interpreter along with the /S switch. If you try
to run the .scr like an .exe file (or rename .scr to .exe), nothing
happens. The /S switch is needed.

Do a find on .scr files in your Windows instance. One is mystify.scr.
Copy elsewhere (e.g., C:\Temp). Open a command shell and navigate to
C:\Temp. Run:

mystify.scr /S

and the screensaver runs ... just like any program.

You could use "assoc .scr=" to remove the filetype association, but that
won't prevent from running an .scr file as a program - which is what is
an .scr screensaver file. Only because of a change in some later
version of Windows that requires the /S command-line switch are users
prevented from accidentally double-clicking on an .scr file to run it.
I don't know which version of Windows added the /S requirement.

file.scr
Does nothing, or displays a list a settings dialog for the screensaver.

file.scr /S
Runs the code inside the .scr file.

See more command-line switches at:
https://en.wikipedia.org/wiki/Screen...rosoft_Windows.

Because screensavers are executable code, old screensavers may not run
because the WOW (Windows On Windows) emulator is missing. You cannot,
for example, run 16-bit code on a 64-bit Windows. 32-bit Windows can
run 32-bit apps, or 16-bit apps using the WOW32 emulator. 64-bit
Windows can run 64-bit apps, or 32-bit apps using the WOW64 emulator.
Ads