Screensaver .scr File
- In November 2007 the SCR file extension started to be used to transmit a Trojan. As a script or a screen saver this file can execute other files which carry the Trojan. The SCR file may be embedded within a ZIP file which could also contain a file with a double extension.
- What is an SCR file? Screensaver file for Windows, typically stored in the main Windows directory; may be run automatically when the computer is inactive for several minutes (custom settings can be configured using the Screen Saver control panel).
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.[1] The Windows screensaver application scrnsave.scr is located in C:WindowsSystem32, and C:WindowssysWOW64 on 64-bit Windows systems, along with screensavers included with base Windows installations.
SCR is the file extension for a screen saver. So the Photos application of the previous method is running the Photos. SCR application. Also a SCR file is actually a renamed EXE application. The user needs to know that the SCR file type is primarily associated with 'Script' and caused many trojans to enter.
The following screensaver settings are stored in the Registry (HKCUControl PanelDesktop) and could be manipulated to achieve persistence:
SCRNSAVE.exe- set to malicious PE pathScreenSaveActive- set to '1' to enable the screensaverScreenSaverIsSecure- set to '0' to not require a password to unlockScreenSaverTimeout- sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity. [2]
Mitigations
| Mitigation | Description |
|---|---|
| Disable or Remove Feature or Program | Use Group Policy to disable screensavers if they are unnecessary. |
| Execution Prevention | Block .scr files from being executed from non-standard locations. |
Examples
| Name | Description |
|---|---|
| Gazer | Gazer can establish persistence through the system screensaver by configuring it to execute the malware. [2] |
Detection
Monitor process execution and command-line parameters of .scr files. Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior.
Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry. Suspicious paths and PE files may indicate outliers among legitimate screensavers in a network and should be investigated.
References
Is there a way to have a screen saver in Windows 10 show the file names on the pictures displayed?
Win10 Screensaver Scr File Download
Sure would be nice to know exactly where those files are.
Location Of Screensaver Files
3 Answers
If have an old computer with WinXP, search for file ssmypics.scr. That's the MY Pictures Slideshow screensaver. If you don't have a XP computer handy, you can probably find that file online. Copy that file to your Win 10 computer. Right click on the file, choose 'Install' from the drop down.......My Pictures Slideshow should now be available as one of your choices on the Screensaver Settings Panel. You can configure My Pictures Slideshow to show file names. I've done this on Win 7 and Win 10.
In windows 10 they are .scr files, stored in different folders in the
C:WindowsWinSxs
folders.
Search the Windows folder for
.scr
to find them
MoabHow To Remove Screensaver.scr File
Moab
Re putting picture titles in a picture slideshow as screen saver in Windows 10 (It also works for XP, Vista, 7, and 8, according to its creator.), there is a really good program that is pretty easy to use:Here is the URL for it, if it is permitted to give URLS on this site.https://www.gphotoshow.com
I have found that gPhotoShow allows you to have the title shown for each picture. There is a paid and a free version, and I am not sure which one I have, but once you have installed the software, go to your computer's Settings (or right click on the desktop and choose Personalize.
Then over to the left, choose Lockscreen and go way down to the bottom to Screensaver settings.Click on that and in the box that comes up, choose gPhotoShow Screen saver from the list and click (over to the right) on Settings. In Settings, choose the Images tab. I think the little box for Recursive Search needs to be checked.
In that same tab, you need to have the pictures for your slide show in the folder (that you can always find located in your computer's Pictures folder) called 'New folder for gPhotoShow.' I think that installing the program automatically creates this folder for you and you probably have to have your selected pictures in there for gPhotoShow to work. (I have a vague recollection that it didn't work for me until I put the pictures into that particular folder.)
Now you are ready to tweak things so that the titles you have given to the various pictures will show at the bottom of the screen when the slide show is at work. Click on the tab for Images Options. In the box that this brings up, look down to around the middle of the box for 'Image File Informations,' under which there is a little box where you can click for 'Show File Name,' and over to the right you can even decide the color of the font. I am using bright red for that, which seems to show up well against most backgrounds; there is even an option for choosing the size of the font.
I think gPhotoShow is really great--it has many functions, and I have been using it almost from the start after buying a Windows 10 computer maybe a year ago, without ever having any problems with it. There are several different transitions from picture to picture, if you want that--and I do. Sometimes they surprise me. The program will even let you put music to the screen saver, but I have not tried that part of it.
I would like to give credit to whatever site first made me aware of gPhotoShow, but unfortunately, I can't remember.