Windows XP Horror Edition
From Screamer Wiki
 |
This article contains spoilers! |
|---|
Windows XP Horror Edition is a screamer application created by a user WobbyChip, and was first given to Siam Alam to showcase and popularize the virus.
Payload
Windows XP Horror Edition is a malware that was designed to look like a Windows XP update, but instead, it installs a virus onto the user's computer. Upon launching the malware, a false update for Windows XP is installed, and the Windows XP installation music plays in the background. The update appears to be 66% complete when an error message appears on the screen, stating that "Setup cannot copy the file ntdll.dll, Setup will use the file 666.sys." The music changes to a creepy chime soundtrack, the background turns red, and the Windows XP logo changes to an eye with the words "Don't Look Behind You." When the update reaches 100% completion, the screen shows glitchy static before turning black, with the cursor still visible.
After a brief period of time, the screen shows a false Windows XP startup animation in red, with a skull in the logo. The background reappears, and an eye next to the word "welcome" appears. Upon logging in to Windows XP Horror Edition, the user is greeted with a desktop wallpaper full of skulls, a red taskbar with the Start button labeled "DEAD," and four icons labeled "My Computer," "NOTHING," "DON'T OPEN ME.txt," and "Recycle Bin." The background changes to creepy pictures and glitchy effects at certain points, with Thresh's Theme from League of Legends playing in the background.
Clicking the "DEAD" button opens the Start menu, but in red and with "666" on the top bar. Clicking on the programs within the Start menu causes them to disappear. Clicking the icon on the top bar greets the user with a wooden door, which opens after a few moments with a loud squeak sound. The user is then jumpscared by Lisa from the Silent Hills demo, P. T, before being greeted with "GO TO SLEEP" written in blood on the screen.
Opening the "DON'T OPEN ME.txt" file opens a Notepad window with the message "CONGRATULATION YOU OPENED ME, DO YOU WANNA PLAY A GAME, OKEY THEN LOOK BEHIND YOU." The screen then changes to a jumpscare from the videogame Granny, with a very loud screech, followed by "Game Over." The Notepad icon then twitches and cannot be opened again.
The software known as "NOTHING" displays a video called "The Sad Man," created by the animator Jake Lava, upon launching. At certain points during use, the background may change to a Half-Life 3 wallpaper with a trollface version of Bill Gates' head or to other horror images, such as "Sake of Windows XP." Additionally, after displaying several error messages, the software will emit the Nope.avi sound before returning to the desktop.
Upon opening the "My Computer" icon, a message will appear asking the user if they truly wish to "trash" their computer permanently. Selecting "Yes" will result in the My Computer icon moving to the Recycle Bin icon, and the screen will then turn black before presenting a Phantom BB jumpscare from FNaF 3. Following this, the FNaF 1 scream will play, a false BSOD will appear with the message "The problem seems to be caused by the following file 666.sys," and this message will repeat several times in a line-by-line fashion. Finally, the computer will display a real BSOD and reboot.
During the next boot, the software's last payload overwrites the Master Boot Record (MBR) and displays an eye along with the message "I'M WATCHING YOU" at the bottom of the screen. Task Manager cannot stop the software, as it disables Task Manager upon launch.
To fix the overwritten MBR, the user may use the Windows setup loader on the installation media, access the Command Prompt through "Repair Your Computer," and enter the commands "bootrec /fixboot" and "bootrec /fixmbr." Alternatively, the MBR can be repaired using NeoSmart's Easy Recovery Essentials, a recovery/diagnostic tool designed to restore non-functioning computers.
There is a "Peaceful" version of the software that differs from the standard version in two ways. First, after the Phantom BB jumpscare from FNaF 3 and false BSOD, the application simply closes instead of causing the computer to crash with a real BSOD. Second, the user may close the application by pressing either ALT + F4 or CTRL + ALT + DEL.
References
Links
NOTE: The following applications contain multiple screamers, as well as a malicious script that may harm your computer!
- Destructive Version: archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_201811
- Destructive & Peaceful Versions: archive.org/details/winxp.horror.destructive
Showcases