Windows XP Horror Edition: Difference between revisions

Latest revision as of 22:25, 17 December 2023

		This article contains spoilers! Please be advised that the following article contains spoilers for the screamer mentioned in the title or description. If you have not yet experienced the material and wish to avoid spoilers, we recommend that you proceed with caution or refrain from reading until you have done so.

Windows XP Horror Edition (also known as WinXP.Horror.Destructive) is a screamer application created by WobbyChip. It was first distributed to YouTube user Siam Alam to showcase on his channel.

Payload

Windows XP Horror Edition is a program that disguises itself as a Windows XP update, but instead installs malware onto the user's computer. Once launched, the program presents a fake update for Windows XP accompanied by title.wma, better known as Velkommen or the Windows Welcome Music. The update progresses to 66% completion before issuing an error message that reads:

Setup cannot copy the file ntdll.dll  
Setup will use the file 666.sys

When the user clicks "OK", the background turns red, and the Windows XP logo changes to an monochromatic eye with the text "Don't Look Behind You" accompanied by the song "Creepy Music Box" by Shane Keen. At 100% completion, the screen switches to glitchy static before turning black, with the cursor still visible. After a brief pause, the screen displays a red Windows XP startup animation where the logo is replaced with a red skull with eyes looking towards the user. After the animation finishes, it proceeds to the Welcome screen which is now red and has a black, crying eye.

Once the user boots into Windows XP Horror Edition, they are greeted by a desktop wallpaper full of skulls, the Start button replaced with text reading "DEAD" and a bloody white hand, and four icons labeled "My Computer," "NOTHING," "DON'T OPEN ME.txt," and "Recycle Bin." The desktop background changes to various creepy pictures and glitchy effects, accompanied by "Thresh, the Chain Warden" from League of Legends. The malware also changes the default cursor to a bloody cursor, and when hovering over certain assets, it changes to an eyeball cursor.

Clicking the button labeled "DEAD" opens the Start menu, which appears in red and shows that the username has been changed to "666" and the user icon has been changed. There are two lines of gibberish text with blood splatters, and clicking on them causes them to disappear. Clicking the user icon greets the user with a wooden door, which opens after a few moments with a loud squeaking sound. The user is then jumpscared by Lisa from the Silent Hills demo, P.T., and then is greeted with the text "GO TO SLEEP" written in blood on the screen. From this point forward, the user icon appears to twitch in a glitchy manner whenever the Start menu is opened.

Opening the "DON'T OPEN ME.txt" file opens a fake Notepad window with bloody text that reads:

CONGRATULATION YOU OPENED ME
DO YOU WANNA PLAY A GAME
OKEY THEN LOOK BEHIND YOU

The screen then switches to a jumpscare from the video game Granny with a very loud screech, followed by text that reads "Game Over". The Notepad icon then twitches in a glitchy fashion and cannot be opened again.

The file labeled "NOTHING" displays the animation "The Sad Man" by Jake Lava upon launching. Similar to DON'T OPEN ME.txt, after the animation finishes, the icon then twitches in a glitchy manner and cannot be opened again.

Clicking Recycle Bin merely causes the icon to glitch in a similar manner to DON'T OPEN ME.txt and NOTHING.

At certain points during use, the screen may change to a Half-Life 3 image with a Trollface version of Gabe Newell accompanied by the "Valve Theme" or to other screamers. Additionally, after displaying several error messages that read "Task Manager has been disabled by your administrator." the program will emit the "nope.avi" soundbite before returning to the desktop.

When the user clicks the My Computer icon, a message will appear reading:

DO YOU SERIOUSLY WANT TRASH YOUR COMPUTER FOREVER?

Selecting "Yes" will result in the My Computer icon moving to the Recycle Bin. Then, the screen will then turn black and display a Phantom Balloon Boy jumpscare from Five Nights at Freddy's 3 accompanied by the scream from Five Night's at Freddy's. Then, a fake red Screen of Death (RSoD) will appear with the message:

A problem has been detected and windows has been shut down to prevent damage 
to your computer.

The problem seems to be caused by the following file: 666.SYS

PAGE_FAULT_IN_NONPAGED_AREA 

If this is the first time you've seen this stop error screen, 
restart your computer. If this screen appears again, follow these steps: 

Check to make sure any new hardware or software is properly installed. 
If this is a new installation, ask your hardware or software maufacturer 
for any windows Updates you might need. 

If problems continue, disable or remove any newly installed hardware 
or software. Disable BIOS memory options such as caching or shadowing. 
If you need to use Safe Mode to remove or disable components, restart 
your computer, press F6 to select Advanced Startup Options, and then 
select Safe Mode. 

Technical information: 

***STOP 0x666666666 (0x6666666666,0x66666666,0x66666666,0x66666666)

This message will repeat several times in a line-by-line fashion. Finally, the computer will display a real Blue Screen of Death (BSoD) and reboot. Upon rebooting, the program's final payload overwrites the Master Boot Record (MBR) with an image displaying a monochromatic eye along with the message:

I'M WATCHING YOU
Created by WobbyChip

Restore Solution

The program disables Task Manager upon launch, making it impossible to end the process using this tool. To fix the overwritten MBR, the user may use the Windows Setup loader on the installation media, access the Command Prompt through Repair Your Computer, and enter the commands bootrec /fixboot and bootrec /fixmbr. Alternatively, the MBR can be repaired using NeoSmart's Easy Recovery Essentials, a recovery and diagnostic tool designed to restore non-functioning Windows computers.

Peaceful Version

The Peaceful version of the software differs from the Destructive version in that after the Phantom Balloon Boy jumpscare and fake RSoD, the application simply closes instead of triggering a BSoD and overwriting the MBR.

Gallery

The bloody cursor.
The eyeball cursor.
The update screen payload.
The Welcome screen.
The desktop change payload.
The Start menu.
The wooden door.
The GO TO SLEEP text after the Lisa jumpscare.
The Notepad message.
The Half-Life 3 image.

Showcases

Links

NOTE: The following applications contain multiple screamers, as well as a malicious script that will harm your computer!

Destructive Version: archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_201903
Destructive & Peaceful Versions: archive.org/details/winxp.horror.destructive

Comments

Loading comments...

@@ Line 1: / Line 1: @@
+{{Featured}}
 {{#seo:
 |keywords="Windows XP Horror Edition, WobbyChip Windows XP Horror Edition"
@@ Line 5: / Line 6: @@
 {{Infobox
 |title = Windows XP Horror Edition
-|image = XPXP.png
+|image = WinXPHorror Icon.png
 |maker = WobbyChip
 |type = Application
 |date = 2018
-|imagecaption = The update screen.
+|imagecaption = The .exe icon.
 }}
-[[File:Gotosleep.png|thumb|120px|GO TO SLEEP]]
-'''Windows XP Horror Edition''' is a [[screamer]] application created by a user WobbyChip, and was first given to Siam Alam to showcase and popularize the virus.
-==Payload==
+'''Windows XP Horror Edition''' (also known as '''WinXP.Horror.Destructive''') is a [[screamer]] [[application]] created by WobbyChip. It was first distributed to [[YouTube]] user Siam Alam to showcase on his channel.
-Upon launch, the virus installs a false update for Windows XP, and plays the Windows XP installation music in the background. When the "update" is 66% complete, the music stops, and an error message appears on the screen, saying "Setup cannot copy the file ntdll.dll, Setup will use the file 666.sys." The music is replaced with a creepy chime soundtrack, the background turns red, and the Windows XP logo changes to an eye along with "Don't Look Behind You." When the "update" is 100% complete, the screen then shows what appears to be glitchy static, before turning black. The cursor is still visible.
+== Payload==
+Windows XP Horror Edition is a program that disguises itself as a [[wikipedia:Windows XP|Windows XP]] update, but instead installs malware onto the user's computer. Once launched, the program presents a fake update for Windows XP accompanied by [https://youtu.be/5xk-CUTwg1Q title.wma], better known as Velkommen or the Windows Welcome Music. The update progresses to 66% completion before issuing an error message that reads:<pre>
+Setup cannot copy the file ntdll.dll
+Setup will use the file 666.sys
+</pre>When the user clicks "OK", the background turns red, and the Windows XP logo changes to an monochromatic eye with the text "Don't Look Behind You" accompanied by the song "[https://www.youtube.com/watch?v=_xABEpnkht8 Creepy Music Box]" by Shane Keen. At 100% completion, the screen switches to glitchy static before turning black, with the cursor still visible. After a brief pause, the screen displays a red Windows XP startup animation where the logo is replaced with a red skull with eyes looking towards the user. After the animation finishes, it proceeds to the Welcome screen which is now red and has a black, crying eye.
-The screen stays black briefly, before showing a false Windows XP startup animation all in red, and with a skull in the logo.
+Once the user boots into Windows XP Horror Edition, they are greeted by a desktop wallpaper full of skulls, the Start button replaced with text reading "''DEAD''" and a bloody white hand, and four icons labeled "My Computer," "NOTHING," "DON'T OPEN ME.txt," and "Recycle Bin." The desktop background changes to various creepy pictures and glitchy effects, accompanied by "[https://youtu.be/6WyH5E8Xs0c Thresh, the Chain Warden]" from ''[[wikipedia:League of Legends|League of Legends]]''. The malware also changes the default cursor to a bloody cursor, and when hovering over certain assets, it changes to an eyeball cursor.
-The red background reappears, along with an eye next to the word "welcome." Logging in to Windows XP Horror Edition greets the user with a desktop wallpaper full of skulls, a red taskbar with the Start button labeled "DEAD," and four icons labeled, "My Computer," "NOTHING," "DON'T OPEN ME.txt" and "Recycle Bin." The background changes to creepy pictures and glitchy effects at certain points. Thresh's Theme from League of Legends plays in the background.'<ref><nowiki>https://www.youtube.com/watch?v=6WyH5E8Xs0c</nowiki> - Thresh, the Chain Warden | Login Screen - League of Legends</ref>
+Clicking the button labeled "''DEAD''" opens the Start menu, which appears in red and shows that the username has been changed to "666" and the user icon has been changed. There are two lines of gibberish text with blood splatters, and clicking on them causes them to disappear. Clicking the user icon greets the user with a wooden door, which opens after a few moments with a loud squeaking sound. The user is then [[jumpscare|jumpscared]] by Lisa from the ''[[wikipedia:Silent Hills|Silent Hills]]'' demo, [[wikipedia:P.T._(video_game)|''P.T.'']], and then is greeted with the text "GO TO SLEEP" written in blood on the screen. From this point forward, the user icon appears to twitch in a glitchy manner whenever the Start menu is opened.
-Clicking the "DEAD" button opens the Start menu but in red and with "666" on the top bar. Clicking on the programs within the Start menu causes them to disappear. Clicking the icon on the top bar greets the user with a wooden door. After a few moments the door opens, along with a loud squeak sound. The user is jumpscared by Lisa from the Silent Hills demo, ''P. T'' (same character but not a screamer face from [[Micromachines.net23.net]]), along with the loud scream from [[The Maze]], before then being greeted with "GO TO SLEEP" written in blood on the screen.
+Opening the "DON'T OPEN ME.txt" file opens a fake Notepad window with bloody text that reads:<pre>
+CONGRATULATION YOU OPENED ME
+DO YOU WANNA PLAY A GAME
+OKEY THEN LOOK BEHIND YOU</pre> The screen then switches to a jumpscare from the video game ''[[wikipedia:Granny (video game)|Granny]]'' with a very loud screech, followed by text that reads "Game Over". The Notepad icon then twitches in a glitchy fashion and cannot be opened again.
-Opening the "DON'T OPEN ME.txt" file opens a Notepad window with, "CONGRATULATION YOU OPENED ME, DO YOU WANNA PLAY A GAME, OKEY THEN LOOK BEHIND YOU." The screen then changes to a jumpscare from the videogame Granny with a very loud screech, and then displays "Game Over." The Notepad icon then twitches and can't be opened again.
+The file labeled "NOTHING" displays the animation "[https://www.youtube.com/watch?v=KqXbz4kIWGE The Sad Man]" by Jake Lava upon launching. Similar to DON'T OPEN ME.txt, after the animation finishes, the icon then twitches in a glitchy manner and cannot be opened again.
-Opening "NOTHING" greets the user with a video known as The Sad Man, by the animator Jake Lava.<ref><nowiki>https://www.youtube.com/watch?v=KqXbz4kIWGE</nowiki> - The Sad Man, by Jake Lava</ref>
+Clicking Recycle Bin merely causes the icon to glitch in a similar manner to DON'T OPEN ME.txt and NOTHING.
-At certain points, the background changes to a Half-Life 3 wallpaper, with a trollface version of Bill Gates head, but it is also possible to change to the "Sake of Windows XP" or other horror images. After a few error messages, the Nope.avi sound is played, before switching back to the desktop.
+At certain points during use, the screen may change to a ''[[wikipedia:Half-Life 3|Half-Life 3]]'' image with a [[wikipedia:Trollface|Trollface]] version of [[wikipedia:Gabe_Newell|Gabe Newell]] accompanied by the "[https://www.youtube.com/watch?v=DdcdeS9kzFo Valve Theme]" or to other screamers. Additionally, after displaying several error messages that read "Task Manager has been disabled by your administrator." the program will emit the "[https://www.youtube.com/watch?v=gvdf5n-zI14 nope.avi]" soundbite before returning to the desktop.
-Opening the "My Computer" icon displays a message saying "DO YOU SERIOUSLY WANT TO TRASH YOUR COMPUTER FOREVER?" Clicking Yes will cause the My Computer icon to move to the Recycle Bin icon. The screen then turns black, before showing a Phantom BB jumpscare from FNaF 3, playing the FNaF 1 scream, then showing a false BSOD which says "The problem seems to be caused by the following file 666.sys." The messages appear line by line several times, before the computer shows a real BSOD, and then reboots.
+When the user clicks the My Computer icon, a message will appear reading:
+ DO YOU SERIOUSLY WANT TRASH YOUR COMPUTER FOREVER?
+Selecting "Yes" will result in the My Computer icon moving to the Recycle Bin. Then, the screen will then turn black and display a Phantom Balloon Boy [[jumpscare]] from ''[[wikipedia:Five Nights at Freddy's 3|Five Nights at Freddy's 3]]'' accompanied by the scream from [[wikipedia:Five_Nights_at_Freddy's_(video_game)|''Five Night's at Freddy's'']]. Then, a fake red [[wikipedia:Screen_of_death|Screen of Death]] (RSoD) will appear with the message:<pre>
+A problem has been detected and windows has been shut down to prevent damage
+to your computer.
-The last payload of the malware overwrites the MBR upon the next boot, and then displays an eye, along with "I'M WATCHING YOU" on the bottom.
+The problem seems to be caused by the following file: 666.SYS
-Stopping it through Task Manager is impossible, as the malware disables its use upon launch.
+PAGE_FAULT_IN_NONPAGED_AREA
-To fix the overwritten MBR, run the Windows setup loader on the installation media, access the Command Prompt through Repair Your Computer, and then type the following commands: "bootrec /fixboot, bootrec /fixmbr"
+If this is the first time you've seen this stop error screen,
-The MBR can also be fixed through NeoSmart's Easy Recovery Essentials, a recovery/diagnostic tool that can be used to restore non-functioning computers.
+restart your computer. If this screen appears again, follow these steps:
-There is also a Peaceful version of the application, with only two differences; after the Phantom BB jumpscare from FNAF 3 followed by a false BSOD that repeats the same line, the application just closes, instead of actually crashing the computer with a real BSOD, and pressing either ALT + F4 or CTRL + ALT + DEL closes the application.
+Check to make sure any new hardware or software is properly installed.
+If this is a new installation, ask your hardware or software maufacturer
+for any windows Updates you might need.
-== References ==
+If problems continue, disable or remove any newly installed hardware
-<references />
+or software. Disable BIOS memory options such as caching or shadowing.
-== Links ==
+If you need to use Safe Mode to remove or disable components, restart
-<u>NOTE</u>: The following applications contain multiple [[screamers]], as well as a [[wikipedia:Cross-sit scripting|malicious script]] that may harm your computer!
+your computer, press F6 to select Advanced Startup Options, and then
-*'''Destructive Version:''' archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_201811
+select Safe Mode.
-*'''Destructive & Peaceful Versions:''' archive.org/details/winxp.horror.destructive
+Technical information:
+***STOP 0x666666666 (0x6666666666,0x66666666,0x66666666,0x66666666)</pre>
+This message will repeat several times in a line-by-line fashion. Finally, the computer will display a real [[wikipedia:Blue_screen_of_death|Blue Screen of Death]] (BSoD) and reboot. Upon rebooting, the program's final payload overwrites the [[wikipedia:Master_boot_record|Master Boot Record]] (MBR) with an image displaying a monochromatic eye along with the message:<div style="text-align: center;">
+ I'M WATCHING YOU
+ Created by WobbyChip
+</div>
+==Restore Solution==
+The program disables Task Manager upon launch, making it impossible to end the process using this tool. To fix the overwritten MBR, the user may use the Windows Setup loader on the installation media, access the Command Prompt through Repair Your Computer, and enter the commands <code>bootrec /fixboot</code> and <code>bootrec /fixmbr</code>. Alternatively, the MBR can be repaired using NeoSmart's Easy Recovery Essentials, a recovery and diagnostic tool designed to restore non-functioning Windows computers.
+==Peaceful Version==
+The Peaceful version of the software differs from the Destructive version in that after the Phantom Balloon Boy jumpscare and fake RSoD, the application simply closes instead of triggering a BSoD and overwriting the MBR.
+==Gallery ==
+<gallery widths="200" position="center" captionsize="small" captionalign="center" spacing="small">
+File:WinXPHorror cursor.png|The bloody cursor.
+File:WinXP 32761.png|The eyeball cursor.
+File:WinXPHorror Update.png|The update screen payload.
+File:WinXPHorror Login.png|The Welcome screen.
+File:WinXPHorror Desktop.png|The desktop change payload.
+File:WinXPHorror StartMenu.png|The Start menu.
+File:WinXPHorror Door.jpg|The wooden door.
+File:WinXPHorror GoToSleep.jpg|The GO TO SLEEP text after the Lisa jumpscare.
+File:WinXPHorror Notepad.jpeg|The Notepad message.
+File:WinXPHorror HL3.jpg|The ''Half-Life 3'' image.
+</gallery>
 ==Showcases==
+<div style="text-align: center;">
 <youtube width="320" height="180">2UX4dbEXAOE</youtube>
 <youtube width="320" height="180">LRZ7y0xrnQo</youtube>
-<youtube width="320" height="180">aaulnyJpOF0</youtube>
+<youtube width="320" height="180">Qjgaj64h6qc</youtube>
 <youtube width="320" height="180">RITXo58kHLg</youtube>
 <youtube width="320" height="180">YvlPcPTTAws</youtube>
-<br>
+<youtube width="320" height="180">u3z53Gm18R8</youtube>
+</div>
+==Links==
+<u>NOTE</u>: The following applications contain multiple [[screamers]], <span style="color:red">as well as a [[malicious script]] that will harm your computer!
+*'''Destructive Version:''' archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_201903
+*'''Destructive & Peaceful Versions:''' archive.org/details/winxp.horror.destructive
 {{Maliciousnav}}
 {{Comments}}
-[[Category:Malicious scripts]]
+[[Category:Malware]][[Category:Malicious scripts]]
 [[Category:Applications]]
 [[Category:Other makers]]

Windows XP Horror Edition: Difference between revisions

Latest revision as of 22:25, 17 December 2023

Contents

Payload

Restore Solution

Peaceful Version

Gallery

Showcases

Links

Comments

Comments

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

Navigation

Community

Screamer Library

Tools