ScreenWings
About ScreenWings
Software that takes screenshots without being asked is a real category of unpleasantness, and it exists because a picture of the screen captures what encryption and passwords cannot protect, which is whatever you were looking at. ScreenWings exists to make those pictures useless.
Black instead of your screen
The ScreenWings mechanism is direct. It interferes with the ordinary route software uses to ask the system for an image of the screen, so anything taking that route receives black rather than content. Protection is set per display, so a machine with two monitors can blank one and leave the other alone.
Nothing is installed. It runs from wherever you put it, sits in the tray, and does nothing else at all.
What it stops, and what it does not
Being precise about the ScreenWings boundary matters more than anything else here, because the gap between the two is where people form the wrong impression.
It stops software using the standard capture route, which covers a good proportion of the screenshot-taking nuisances people actually encounter.
It does not stop a camera pointed at the screen. It does not stop a hardware capture device sitting between the computer and the monitor. And it does not stop software written to capture by other means, of which there are several, because anything determined enough to avoid the ordinary route will avoid this too.
So the protection is real against one class of tool and absent against others. Establishing what is actually running on the machine is a separate exercise, and a process viewer showing every running program and what it has loaded answers that question directly.
The larger question it does not address
Here is the point that deserves stating plainly, because installing this can produce a false sense of having solved something.
If software on your machine is taking screenshots without permission, the machine is compromised. That is the actual situation, and screenshots are one symptom of it. Whatever put that software there can also record keystrokes, read files, capture what you type into a password field and send all of it elsewhere, none of which involves a picture of the screen.
Blocking the screenshots leaves every one of those capabilities untouched. ScreenWings treats a symptom, and treating a symptom on a compromised machine is not protection.
The correct response to that situation is finding and removing what is there, and Malwarebytes scans specifically for that class of software and runs alongside whatever resident protection is already installed.
It blocks your captures too
The practical ScreenWings consequence people meet within a day. While protection is active, your own screenshots come out black as well, because the tool cannot distinguish between a capture you wanted and one you did not.
Screen sharing during a call goes the same way, as does any remote support session where somebody is trying to see your screen to help you. Both appear as a black rectangle to the other party.
That means switching it on for the specific moments you care about rather than leaving it running permanently, which is how most people end up using it. For deliberate captures with annotation and editing, ShareX is the tool, and the two cannot both be active.
Conclusion
ScreenWings does exactly what it says within a narrow boundary. Software asking the system for a picture of your screen gets black instead, per display, from a program that installs nothing and takes seconds to enable.
Be clear about what that means. It is a targeted countermeasure rather than protection, and if something on your machine is taking screenshots uninvited, the screenshots are not your problem.
The problem is whatever put it there, which can do considerably more than take pictures, and blocking one capability while leaving the rest untouched is a poor trade to feel reassured by. Find out what is running first. Use this afterwards, for the specific moments where it actually helps.
Pros & Cons
- Blocks the ordinary screen capture route, so those screenshots return black
- Protection is set per display rather than for the whole machine
- Runs from anywhere with nothing installed and nothing left behind
- Tiny and does one thing, with no configuration to work through
- Toggling it on for a specific moment is instant
- Only stops software using the standard capture route
- No defence against a camera, a hardware capture device, or other capture methods
- Blocks your own screenshots and screen sharing while active
- Addresses a symptom rather than the compromise that produced it
- Can create a false impression of protection on a machine that is not clean
Frequently asked questions
Software requesting an image of the screen through the ordinary system route. Anything taking that route receives black instead of content, and protection can be applied to individual displays rather than all of them.
No. A camera pointed at the screen, a hardware capture device between computer and monitor, and software written to capture by other means all continue to work. It covers one route rather than every route.
Yes, and screen sharing during calls as well, since it cannot tell a wanted capture from an unwanted one. Most people switch it on for particular moments rather than leaving it running.
No. Its purpose is defeating unwanted capture software, and on a machine with none there is nothing for it to block. If you suspect there is something, scanning for it is a more useful response than blocking one of its capabilities.