Xalgaldy.vir is an Xbox 360 file infector.

Note: All code beyond here was imported from Xalgaldy.vir on the VirusInfo Wiki due to inactivity and chance of vandalism. No one could be contacted for permission. The Malware Wiki community does not take any credit for the following text, with the exception of the sources section. Original authors are mentioned Here! This note was left by Godzilla Gamer (talk) 17:57, July 14, 2014 (UTC). Remove this note if more First Party info is added!.


Xalglady.vir is executed first on Windows (as Xalglady.vir.exe). The virus adds the end codestring of VEX1E with textstrings similar to that of Virdem's and Nodcrash.vir's.

Xalglady.vir's payload on the Xbox 360's YouTube App will always cause a Pre-roll Ad on certain videos to crash, however it cannot harm the system in anyway.


Xalglady.vir is also known for two variants that also create a payload on the Xbox 360's YouTube App that always cause Ads on certain videos to freeze. Its clone is known to crash Ads during the video.

Another is the IdentityTheft Trojan that causes the system to crash when an Identity Theft Pre-roll Ad is triggered, therefore it is harmful unlike the other variables.


Xalglady.vir was created on 10 November 2013 as a test run, with its variants on later dates. The name was based on Xalnaga.a which was recorded by TomKTW (a YouTube account) at the time, and 'Ad', with the .vir (virus) as its extension.

The code VEX1E is related to Vexe1 because of one of the videos on that account when spotted on 14 June 2014 had Pre-roll Ads continuously rather than Ads usually during the video and Pre-roll Ads being rare. This was later recorded with an RSoD hang.

It is part of project AdBAN as a counter for the removal and crashes of Pre-roll Ads.


Xalgaldy.vir on the VirusInfo Wiki

Community content is available under CC-BY-SA unless otherwise noted.