Draft:GDI malware
Submission declined on 9 May 2025 by Greenman (talk).
Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
|  |
 | This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
|
 | This draft may require cleanup to meet Wikipedia's quality standards. The specific problem is: <Fill reason here>. Please help improve this draft if you can; the talk page may contain suggestions. |
GDI malwares are malwares made for the Windows operating system that have been developed by various creators. None of these malwares are intended for malicious purposes, they are instead meant to be tested for educational purposes, usually in VMware or VirtualBox.[1][2]
Execution
[edit]Upon execution, they often display 2 warnings, asking the user if they want to run the malware, to prevent further execution by users who are running it on their main device. If the user answers "Yes" to both warnings, the malware will run.
GDI payloads
[edit]The main part of these malwares are the GDI effects. Each payload features GDI visual effects on the screen and Bytebeat sounds.
Other payloads
[edit]Some malwares have other non-GDI payloads, including:
- Displaying a fake error message.
- Shaking open windows.
- Opening random system programs.
Destructive payloads
[edit]Some GDI malwares have safe versions that do not have the destructive payloads listed below, but still have the GDI payloads.
Destructive versions of GDI malware can run the following destructive payloads:
- Overwrite the Master Boot Record.
- Disable Task Manager, Registry Editor, Command Prompt, and other important Windows utilities.
- Corrupt the BCD.
- Unmount all drives.
Final destruction
[edit]Once the malware runs its last payload, the system will crash with a Blue Screen of Death. The system will then reboot to an overwritten MBR, showing either an image or some text, depending on the malware.
Examples of GDI malwares
[edit]![[icon]](/wiki/File:Wiki_letter_w_cropped.svg){kind=small} | This section needs expansion. You can help by adding to it. |
- Trihydridoarsenic.exe
- Gadolinium.exe
- xpmalwrdest.exe
- destr3ktdows.exe
- Heptoxide.exe
- Triphenylarsine.exe
- Technetium.exe
- xgqgxtxxgs.exe
- rwqvhhbsld.exe
- trichloromethane.exe
- Holmium.exe
- salinewin.exe
- ksdcbrctys.exe
- MS 0735.6+7421.exe
- DETTAMROFNIW.exe
- wgwcpdpgbf.exe
- dhzfxwwdll.exe
- oxhzulzwrt.exe
- jwzyexgnlc.exe
- 2,3,7,8-Tetrachlorodibenzodioxin.exe
- btfoiuthns.exe
- Olthaltlzpz.exe
- Cytochalasin.exe
- Getaparane.exe
- Hexachlorocyclohexane.exe
- xjmjivqdmpn.exe
- dlwxzypwwzdtd.exe
- kclglegrgq.exe
- Phenylsilatrane.exe
- webm.exe
- Oxymorphazone.exe
- cdm.exe
- APM 08279+5255.exe
- xcf.exe
- in-depth (not just passing mentions about the subject)
- reliable
- secondary
- independent of the subject
Make sure you add references that meet these criteria before resubmitting. Learn about mistakes to avoid when addressing this issue. If no additional references exist, the subject is not suitable for Wikipedia.