Malware

Malware is what got me into making videos. Here I document my favourite viruses: how they work, where they came from, what they do to a PC, and most importantly, how to protect yourself from them. Some are funny, some are terrifying, and some made history.

Everything here is for education. I never share download links for malware, and you won’t find any on this site.

Trojanc. 2019

Windows XP Horror Edition

A friendly Windows XP update that stops at 66%, then turns red and starts screaming. The screamer that scared me as a kid.

Trojanc. 2004

You Are an Idiot

Three smiley faces, a laughing song and windows that multiply when you close them. Why it froze PCs in 2004, and why it can’t today.

Worm2000

ILOVEYOU

A fake love letter in your inbox, May 2000. One click, and it mailed itself to everyone you knew. The most famous email worm ever.

Trojan2016

000.exe

The jump-scare virus that renames you “UR NEXT” and wipes your desktop, then reboots. Terrifying to watch, but mostly harmless and reversible.

Trojan2016

MEMZ

Leurak’s joke virus that fills your screen with memes, then replaces Windows with a Nyan Cat. How it works and my tests.

Trojan2016

VineMEMZ

The special MEMZ edition made for Vinesauce Joel. No warnings, more chaos. I tested it on Windows 11.

Ransomware2016–17

Petya & NotPetya

The red skull that encrypted the whole hard drive, and the copycat that became the most expensive cyberattack ever.

Ransomware2017

WannaCry

A ransomware worm built on a leaked NSA exploit, stopped by a $10 domain name. The full story, its lessons and my 2022 test.

Scam2006–11

Fake Antivirus & Scams

Rogue antiviruses that invented infections to sell you a cure, and the phone scams that replaced them.

How I test malware safely

I’ve accidentally destroyed my own PC twice, so I learned this the hard way. If you want to experiment with malware yourself, these are the rules I follow. None of them makes it 100% safe; together they make an accident much less likely.

Never on your main PC. Use a virtual machine (VirtualBox or VMware) or Windows Sandbox, which is built into Windows 10 and 11 Pro and deletes everything when you close it. For tests on real hardware, I use an old PC with nothing personal on it.
Take a snapshot of the virtual machine before running anything, so you can go back in one click.
Cut the network. Remove the VM’s network adapter or set it to “Not attached”: the default NAT mode still gives the VM internet access, and a worm like WannaCry or NotPetya can use it to reach other devices on your Wi-Fi.
No shared folders, no shared clipboard, no drag and drop, and no USB drives connected to the test machine. Every one of those is a door between the VM and your real PC.
Keep VirtualBox, VMware and Windows itself updated. Bugs that let malware break out of a virtual machine are rare, but they have been found, and updates are what close them.
Never log in to your real accounts inside the test machine.
Be careful where samples come from. Many “MEMZ download” sites bundle extra malware. Real researchers get samples from trusted malware databases, and you don’t need one to learn: watching tests is completely safe.

A virtual machine is a strong wall, not a perfect one. Isolation lowers the risk a lot, but it’s never an absolute guarantee: a misconfigured setting, a shared folder you forgot about or a rare escape bug can all let something through. That’s why the PC you run your tests on should have its important files backed up somewhere else, too.

Remember: creating or spreading malware against other people’s computers is illegal almost everywhere. Testing on machines you own, for learning, is the only acceptable way.

More from my Malware Series

Not every test has its own article yet. Here’s Salinewin, a GDI malware that turns Windows 11 into a “party mode” of colours and effects:

You can find all my tests on my YouTube channel.