Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 808793" data-attributes="member: 32260">I noticed that people on other forums have a problem with understanding how SmartScreen works.First, it is not generally true that if the archive has Mark OF The Web (MOTW) after downloading from the Internet, then the extracted EXE file will have MOTW too. This is not true, for example, when the file was extracted by 7-ZIP.Furthermore, one member noticed that:<ol>
<li data-xf-list-type="ol">After running (from the Explorer) the downloaded file.exe, the Mark OF The Web is removed from the file by the SmartScreen.</li>
<li data-xf-list-type="ol">When running the downloaded file.exe via the command prompt, the Mark OF The Web is not removed from the file by the SmartScreen.</li>
</ol>The member&#039;s conclusion ---&gt; &quot;looks like a bug&quot;.But, in fact it is not, because running the file.exe from the command prompt is equal to the command:&nbsp; cmd.exe /k file.exe. The file is run by cmd shell that does not trigger the SmartScreen. SmartScreen checks only cmd.exe and ignores file.exe. That is why the MOTW is not removed - simply the file is not checked by SmartScreen, so SmartScreen cannot remove MOTW.If one uses the &quot;start&quot; command in the cmd console, then it is equal to:cmd.exe /k start file.exe. The SmartScreen is now triggered (like from Explorer) by using the start command. In this case, the MOTW will be removed (if the file.exe is accepted by SmartScreen).</blockquote>

[QUOTE="Andy Ful, post: 808793, member: 32260"] I noticed that people on other forums have a problem with understanding how SmartScreen works. First, it is not generally true that if the archive has Mark OF The Web (MOTW) after downloading from the Internet, then the extracted EXE file will have MOTW too. This is not true, for example, when the file was extracted by 7-ZIP. Furthermore, one member noticed that: [LIST=1] [*]After running (from the Explorer) the downloaded file.exe, the Mark OF The Web is removed from the file by the SmartScreen. [*]When running the downloaded file.exe via the command prompt, the Mark OF The Web is not removed from the file by the SmartScreen. [/LIST] The member's conclusion ---> "looks like a bug". But, in fact it is not, because running the file.exe from the command prompt is equal to the command: [COLOR=rgb(0, 168, 133)][B]cmd.exe /k file.exe. [/B][/COLOR]The file is run by cmd shell that does not trigger the SmartScreen. SmartScreen checks only cmd.exe and ignores file.exe. That is why the MOTW is not removed - simply the file is not checked by SmartScreen, so SmartScreen cannot remove MOTW. If one uses the "start" command in the cmd console, then it is equal to: [COLOR=rgb(41, 105, 176)][B]cmd.exe /k start file.exe. [/B][/COLOR]The SmartScreen is now triggered (like from Explorer) by using the start command. In this case, the MOTW will be removed (if the file.exe is accepted by SmartScreen). [/QUOTE]

Verification