Let’s stare at the Screensaver again, shall we?

April 7, 2018 in Trivia

You know you can change your screensaver, right?

You know the screensaver used to be configured inside the system.ini file, the [boot] section, the SCRNSAVE.EXE setting, right?

You know the configuration is now stored under HKCU\Control Panel\Desktop\Scrnsave.exe, right?

So…

Explain this:

vs.

When the system detects 1 minute of non-activity, it launches the… 3d Text Screen Saver:

How come then it shows the Bubbles as a Screen Saver of choice ?

When I discovered it, I thought I will be posting yet another part in the Beyond Good Ol’ Run key series; unfortunately, despite various efforts didn’t succeed to force the system to launch the .exe (or .scr really) of my choice when the screensaver kicks off (and with – as I hypothesized – an added bonus of hiding from Autoruns, which didn’t work either :().

Why then posting it?

Well… it’s good to poke around and explain the unexplained.

The reason for the Bubbles showing up, despite the 3d Text Screen Saver being the actual, “real” screensaver is *cough* simple *cough*.

Turns out there is an undocumented setting in Registry that is being used by the control panel applet responsible for Screensaver setup.

The location and the example setting in my case is as follows:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ScreenSavers
SCRNSAVE.EXE=c:\test\Bubbles.scr

It fools the applet which reads the data from this registry and assumes this is an active ScreenSaver, but this value doesn’t seem to be taken into account when the actual screensaver is launched, so we have two settings – one bogus (perhaps a feature that was not fully implemented?), and the real one, that can be at least partially masked by the bogus one (unless you use Autoruns).

Interestingly, changing the screensaver via the Screen Saver Settings panel will result in the actual screensaver being changed, yet the setting seen during the next visit to the panel will remain as set inside the HKLM\…\ScreenSavers key. A side effect of the precedence in which the applet reads the settings (HKLM key first, then the HKCU) vs. the settings that it actually uses to launch the screensaver of choice (based on the HKCU\Control Panel\Desktop\Scrnsave.exe settings and ignoring the HKLM key).

Share this :)

Comments are closed.