Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 544099" data-attributes="member: 32260">Here is the vbs script that works on my Windows 10 Home. It is in the alpha stage (not tested on other machines).Anybody can optimize and modify it.If You want to bypass SRP the script must be wrapped to exe file for asking admin rights.Some executable extensions have to be removed from SRP ( BAT, CMD, JS, JSE, MSI, VBE, VBS, WSF), if You want to run them with &quot;Run As Smartscreen&quot;. I noticed that they are still protected by SRP. The difference is that they are blocked when sponsors (cmd.exe, wscript.exe, msiexex.exe) try to get files in the User Space...RunAsSmartScreen.vbs****************************************************************************************************************************************Set WshShell = CreateObject(&quot;WScript.Shell&quot;)&#039;****** Put the path of the file to fsoFile variable ******Set fso = CreateObject(&quot;Scripting.FileSystemObject&quot;)Set fsoFile = fso.GetFile(WScript.Arguments.Item(0))&#039;****** Check if the file is in the System Space ******If InStr(chr(34)&amp;fsoFile&amp;chr(34), &quot;C:\Windows\&quot;) = 2 Then&nbsp;&nbsp; WshShell.Run(chr(34)&amp;fsoFile&amp;chr(34))&nbsp;&nbsp; WScript.QuitElse&nbsp; &nbsp; If InStr(chr(34)&amp;fsoFile&amp;chr(34),&quot;C:\Program Files\&quot;) = 2 Then&nbsp; &nbsp; &nbsp;&nbsp; WshShell.Run(chr(34)&amp;fsoFile&amp;chr(34))&nbsp; &nbsp; &nbsp;&nbsp; WScript.Quit&nbsp; &nbsp; Else&nbsp; &nbsp; &nbsp; &nbsp; If InStr(chr(34)&amp;fsoFile&amp;chr(34),&quot;C:\Program Files (x86)\&quot;) = 2 Then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; WshShell.Run(chr(34)&amp;fsoFile&amp;chr(34))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; WScript.Quit&nbsp; &nbsp; &nbsp; &nbsp; Else&#039;******&nbsp; Clear all file attributes&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; fsoFile.Attributes = fsoFile.Attributes AND 0&#039;******&nbsp; Create, run and delete another script AddZoneIdentifierToFile.vbs , that adds the proper ADS ******&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Set f = fso.CreateTextFile(&quot;C:\Windows\temp\AddZoneIdentifierToFile.vbs&quot;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; f.WriteLine (&quot;Set WshShell = CreateObject(&quot; &amp; chr(34) &amp; &quot;WScript.Shell&quot; &amp; chr(34)&amp;&quot;)&quot;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; f.WriteLine (&quot;Set fso = CreateObject(&quot; &amp; chr(34) &amp; &quot;Scripting.FileSystemObject&quot; &amp; chr(34)&amp;&quot;)&quot;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; f.WriteLine (&quot;Set f = fso.CreateTextFile(&quot; &amp; chr(34) &amp; fsoFile &amp; &quot;:Zone.Identifier&quot; &amp; chr(34)&amp;&quot;)&quot;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; f.WriteLine (&quot;f.WriteLine &quot; &amp; chr(34) &amp; &quot;[ZoneTransfer]&quot; &amp; chr(34))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; f.WriteLine (&quot;f.WriteLine &quot; &amp; chr(34) &amp; &quot;ZoneId=3&quot; &amp; chr(34))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; f.WriteLine (&quot;f.close&quot;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; WshShell.Run (&quot;C:\Windows\Temp\AddZoneIdentifierToFile.vbs&quot;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Set f = fs<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite120" alt="o_O" title="Er... what?&nbsp; &nbsp; o_O" loading="lazy" data-shortname="o_O" />penTextFile(&quot;C:\Windows\Temp\AddZoneIdentifierToFile.vbs&quot;, 1)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; f.Close&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; WScript.Sleep 1000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; fso.DeleteFile(&quot;C:\Windows\Temp\AddZoneIdentifierToFile.vbs&quot;)&#039;******&nbsp; Run the file&nbsp; ******&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; WshShell.Run(chr(34)&amp;fsoFile&amp;chr(34))&nbsp; &nbsp; &nbsp; &nbsp; End If&nbsp; &nbsp; End IfEnd If&nbsp; Set WshShell = NothingWScript.Quit****************************************************************************************************************************************I do not know why there is the yellow face in the vbs code. You must replace it by dotOdot, similarly to the fso.DeleteFile&nbsp; command...Run_As_SmartScreen.reg***************************************************************************************Windows Registry Editor Version 5.00[HKEY_CLASSES_ROOT\*\shell\Run As SmartScreen]&quot;Icon&quot;=&quot;%windir%\\system32\\SmartScreenSettings.exe&quot;[HKEY_CLASSES_ROOT\*\shell\Run As SmartScreen\command]@=&quot;C:\\Windows\\RunAsSmartscreen.exe \&quot;%1\&quot; %*&quot;***************************************************************************************..Installation:Wrap&nbsp; RunAsSmartscreen.vbs to&nbsp; RunAsSmartscreen.exeCopy RunAsSmartscreen.exe&nbsp; to&nbsp; the&nbsp;&nbsp; &quot;C:\Windows\&quot;&nbsp; folder.Import Run_As_SmartScreen.reg to the&nbsp; Windows&nbsp; Registry...Deinstallation:Remove RunAsSmartscreen.exe from&nbsp;&nbsp; &quot;C:\Windows\&quot;&nbsp; folder.Delete the registry key:&nbsp; [HKEY_CLASSES_ROOT\*\shell\Run with SmartScreen]..This is the more convenient &quot;Run As SmartScreen&quot; solution. I also tried solutions with RunAsSmartscreen.bat or RunAsSmartscreen.vbs without wrapping, but then the launcher is needed, to run the file from the script with admin rights, to bypass SRP. On my machine, the Nirsoft program&nbsp; &quot;nircmd.exe&quot;&nbsp; worked well.</blockquote>

[QUOTE="Andy Ful, post: 544099, member: 32260"] Here is the vbs script that works on my Windows 10 Home. It is in the alpha stage (not tested on other machines). Anybody can optimize and modify it. If You want to bypass SRP the script must be wrapped to exe file for asking admin rights. Some executable extensions have to be removed from SRP ( BAT, CMD, JS, JSE, MSI, VBE, VBS, WSF), if You want to run them with "Run As Smartscreen". I noticed that they are still protected by SRP. The difference is that they are blocked when sponsors (cmd.exe, wscript.exe, msiexex.exe) try to get files in the User Space. . . RunAsSmartScreen.vbs **************************************************************************************************************************************** Set WshShell = CreateObject("WScript.Shell") '****** Put the path of the file to fsoFile variable ****** Set fso = CreateObject("Scripting.FileSystemObject") Set fsoFile = fso.GetFile(WScript.Arguments.Item(0)) '****** Check if the file is in the System Space ****** If InStr(chr(34)&fsoFile&chr(34), "C:\Windows\") = 2 Then WshShell.Run(chr(34)&fsoFile&chr(34)) WScript.Quit Else If InStr(chr(34)&fsoFile&chr(34),"C:\Program Files\") = 2 Then WshShell.Run(chr(34)&fsoFile&chr(34)) WScript.Quit Else If InStr(chr(34)&fsoFile&chr(34),"C:\Program Files (x86)\") = 2 Then WshShell.Run(chr(34)&fsoFile&chr(34)) WScript.Quit Else '****** Clear all file attributes fsoFile.Attributes = fsoFile.Attributes AND 0 '****** Create, run and delete another script AddZoneIdentifierToFile.vbs , that adds the proper ADS ****** Set f = fso.CreateTextFile("C:\Windows\temp\AddZoneIdentifierToFile.vbs") f.WriteLine ("Set WshShell = CreateObject(" & chr(34) & "WScript.Shell" & chr(34)&")") f.WriteLine ("Set fso = CreateObject(" & chr(34) & "Scripting.FileSystemObject" & chr(34)&")") f.WriteLine ("Set f = fso.CreateTextFile(" & chr(34) & fsoFile & ":Zone.Identifier" & chr(34)&")") f.WriteLine ("f.WriteLine " & chr(34) & "[ZoneTransfer]" & chr(34)) f.WriteLine ("f.WriteLine " & chr(34) & "ZoneId=3" & chr(34)) f.WriteLine ("f.close") WshShell.Run ("C:\Windows\Temp\AddZoneIdentifierToFile.vbs") Set f = fso_OpenTextFile("C:\Windows\Temp\AddZoneIdentifierToFile.vbs", 1) f.Close WScript.Sleep 1000 fso.DeleteFile("C:\Windows\Temp\AddZoneIdentifierToFile.vbs") '****** Run the file ****** WshShell.Run(chr(34)&fsoFile&chr(34)) End If End If End If Set WshShell = Nothing WScript.Quit **************************************************************************************************************************************** I do not know why there is the yellow face in the vbs code. You must replace it by dotOdot, similarly to the fso.DeleteFile command. . . Run_As_SmartScreen.reg *************************************************************************************** Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\*\shell\Run As SmartScreen] "Icon"="%windir%\\system32\\SmartScreenSettings.exe" [HKEY_CLASSES_ROOT\*\shell\Run As SmartScreen\command] @="C:\\Windows\\RunAsSmartscreen.exe \"%1\" %*" *************************************************************************************** . . Installation: Wrap RunAsSmartscreen.vbs to RunAsSmartscreen.exe Copy RunAsSmartscreen.exe to the "C:\Windows\" folder. Import Run_As_SmartScreen.reg to the Windows Registry. . . Deinstallation: Remove RunAsSmartscreen.exe from "C:\Windows\" folder. Delete the registry key: [HKEY_CLASSES_ROOT\*\shell\Run with SmartScreen] . . This is the more convenient "Run As SmartScreen" solution. I also tried solutions with RunAsSmartscreen.bat or RunAsSmartscreen.vbs without wrapping, but then the launcher is needed, to run the file from the script with admin rights, to bypass SRP. On my machine, the Nirsoft program "nircmd.exe" worked well. [/QUOTE]

Verification