# what is a '.src' file? **URL:** \ **Category:** Factual Questions\ **Created:** [March 18, 2001, 4:18am UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446 "2001-03-18T04:18:50Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![RAWisSYDNEY](https://avatars.discourse-cdn.com/v4/letter/r/4491bb/32.png) [@RAWisSYDNEY](https://boards.straightdope.com/u/RAWisSYDNEY)\ **Post date:** [March 18, 2001, 4:18am UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/1 "2001-03-18T04:18:50Z")
i just recieved an email about snowwhite and attatched is ‘sexy\_virgin.scr’ immediately i thought it was a virus, but i want to be sure. Does anyone know what an SCR extension means? ---
**Author:** ![barking\_frog](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@barking\_frog](https://boards.straightdope.com/u/barking_frog)\ **Post date:** [March 18, 2001, 4:30am UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/2 "2001-03-18T04:30:11Z")
SCReen saver ---
**Author:** ![SmackFu](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@SmackFu](https://boards.straightdope.com/u/SmackFu)\ **Post date:** [March 18, 2001, 4:43am UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/3 "2001-03-18T04:43:09Z")
And since screen savers are just programs with a different extension, it can still do bad hoodoo to your system. Only install it if you trust the source. ---
**Author:** ![mdf](https://avatars.discourse-cdn.com/v4/letter/m/dbc845/32.png) [@mdf](https://boards.straightdope.com/u/mdf)\ **Post date:** [March 18, 2001, 4:47am UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/4 "2001-03-18T04:47:36Z")
Just don’t. It’s probably a variation of a Hybris worm - I got a similar email a few days ago. Check [here](http://www.europe.fsecure.com/v-descs/hybris.shtml) for more info - there’s a list of text messages at the bottom of the page that are included in the e-mail. -mdf ---
**Author:** ![Montfort](https://avatars.discourse-cdn.com/v4/letter/m/d6d6ee/32.png) [@Montfort](https://boards.straightdope.com/u/Montfort)\ **Post date:** [March 18, 2001, 4:52am UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/5 "2001-03-18T04:52:12Z")
.scr is often a screen saver, but in this case it’s masking a scripted file; aka, a virus. ---
**Author:** ![Lord\_Jim](https://avatars.discourse-cdn.com/v4/letter/l/ecccb3/32.png) [@Lord\_Jim](https://boards.straightdope.com/u/Lord_Jim)\ **Post date:** [March 18, 2001, 3:45pm UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/6 "2001-03-18T15:45:20Z")
Here’s the write up from SARC([W95.Hybris.gen](http://www.symantec.com/avcenter/venc/data/w32.hybris.gen.html)) and McAfee([W32/Hybris.gen@MM](http://vil.mcafee.com/dispVirus.asp?virus_k=98873&)). The snowwhite virus has been around since last September. Jim ---
**Author:** ![Chas.E](https://avatars.discourse-cdn.com/v4/letter/c/e99b99/32.png) [@Chas.E](https://boards.straightdope.com/u/Chas.E)\ **Post date:** [March 18, 2001, 6:31pm UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/7 "2001-03-18T18:31:30Z")
I’m not clear here. Is it an .src or an .scr? A .src file is a source code file, like a C++ source code file. But if someone emailed this to you and you’re not an advanced programmer type person, that probably isn’t it. ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [March 18, 2001, 7:14pm UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/8 "2001-03-18T19:14:37Z")
My money’s on the virus script. **Chas** , the title is probably a typo. **Raw** , the safest thing is to delete it and then tell the person who sent it to you their computer might be infected with a virus. Read the link **JimB** provided. ---
**Author:** ![Lord\_Jim](https://avatars.discourse-cdn.com/v4/letter/l/ecccb3/32.png) [@Lord\_Jim](https://boards.straightdope.com/u/Lord_Jim)\ **Post date:** [March 18, 2001, 8:45pm UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/9 "2001-03-18T20:45:58Z")
To clarify a few points.[ul][li]I agree with Derleth that the title is a typo, since the body of the OP calls out the file name ‘sexy\_virgin.scr’.[_]Sexy\_virgin.scr is one of the several attachment file names that go with the Snowwhite virus, actually a worm, I think.[_]the .SCR extension is for screen saver files. Open Windows Explorer click View \> Options choose File Types tab. Scroll down till you find Screen Saver on the list. You’ll see the extension is SCR [_]And like SmackFu said, they are executable programs just like .EXE files.[_]It isn’t a script file. If you open it in notepad you’ll see executable code, not a script, which is readable text.[/ul]Having screen savers files being executable, instead of a type of script file that could be controlled, is just another favor done for us by MS, so that they aren’t limiting our enjoyment as we watch screen savers destroy our system.[/li] Jim ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [March 18, 2001, 11:13pm UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/10 "2001-03-18T23:13:34Z")
Doesn’t it seem that every new feature Microsoft provides makes it easier for virus writers? Why doesn’t MS ever consider this possibility? ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [March 18, 2001, 11:21pm UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/11 "2001-03-18T23:21:26Z")
> [@](#): > > \*Originally posted by Derleth \* > Tell the person who sent it to you their computer might be infected with a virus. That might not be so easy. In the version I received months ago, the header suggested it came from **[hahaha@sexyfun.net](mailto:hahaha@sexyfun.net),** but according to that site, they are the innocent victims of someone else’s attack. Their address was probably spoofed by a malicious third party. ---
**Author:** ![sewalk](https://avatars.discourse-cdn.com/v4/letter/s/b3f665/32.png) [@sewalk](https://boards.straightdope.com/u/sewalk)\ **Post date:** [March 19, 2001, 6:06am UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/12 "2001-03-19T06:06:49Z")
> [@](#): > > \*Originally posted by Musicat \* > \*\*Doesn’t it seem that every new feature Microsoft provides makes it easier for virus writers? > > Why doesn’t MS ever consider this possibility? > \*\* All operating systems are vulnerable to trojans (a virus is a specific type of trojan horse). The reason that we all hear about susceptibility of new features in MS products is because that is the OS/browser/productivity suite 90% of the world uses. There are most likely similar vulnerabilities in Linux and MacOS but the smaller number of users does three things: 1. It reduces the chances that the trojan programmers are even familiar with these systems, 2. It reduces the number of potential victims (who wants to write a worm that only attacks one user?) 3. Hi, Opal! (1st time I’ve ever done that!) 4. Reduces the likelyhood that the rest of us will even hear about it. What are the chances that Dan Rather will report about a virus that only affects Mac users in Nepal? ---
**Author:** ![Jeremy\_s\_Evil\_Twin](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Jeremy\_s\_Evil\_Twin](https://boards.straightdope.com/u/Jeremy_s_Evil_Twin)\ **Post date:** [March 19, 2001, 7:46am UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/13 "2001-03-19T07:46:28Z")
> [@](#): > > \*Originally posted by Musicat \* > \*\*That might not be so easy. In the version I received months ago, the header suggested it came from _[hahaha@sexyfun.net](mailto:hahaha@sexyfun.net),_ but according to that site, they are the innocent victims of someone else’s attack. Their address was probably spoofed by a malicious third party. \*\* That’s not entirely accurate. “[hahaha@sexyfun.net](mailto:hahaha@sexyfun.net)” is part of the virus itself; no matter where it comes from, the virus will create that address which is completely fake. The [sexyfun.net](http://sexyfun.net) domain didn’t even exist until somebody registered it [as a public service message](http://www.sexyfun.net). From what I can tell, it’s possible to look through the headers and find out from which ISP the email came from, but not the exact person. J.E.T. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [March 19, 2001, 1:07pm UTC](https://boards.straightdope.com/t/what-is-a-src-file/58446/14 "2001-03-19T13:07:41Z")
It is possible to LOOK at the header of an email message, but there is no guarantee that what it says is correct. Someone who wants to cover their tracks is sure to supply bogus info; this is called “spoofing.” This is a legacy from the early days of the Internet when security was not high on the priority list but exchange of info was.