000.exe is the virus that looks like the end of the world and turns out to be a prank. It fills your screen with a creepy video and messages telling you “YOU ARE THE NEXT”, renames your Windows account to “UR NEXT”, wipes your desktop and reboots your PC. It’s terrifying the first time you see it, but unlike MEMZ it never actually kills Windows, and almost everything it does can be undone.
A creepypasta with real code
000.exe was made in 2016 by the YouTuber FlyTech Videos, who built joke viruses to test on camera. It was designed in the style of a creepypasta: a scary internet story. The idea was that you’d find a mysterious file called 000.exe, run it out of curiosity, and get jump-scared. It spread the way creepypastas do, through “I ran the scariest virus” reaction videos, and became one of the most recognisable prank viruses on YouTube.
Unlike most malware, 000.exe isn’t a secret. A few years later FlyTech published the full source code openly along with a “making-of” video, treating it as a joke and a teaching example rather than a real weapon. That’s why we know exactly what it does, step by step, and why it’s safe to write about in detail.
What happens when you open it
1. It traps you on the screen
The moment you open it, 000.exe goes full-screen and starts swallowing your keyboard shortcuts. The usual escape routes (Alt+Tab, the Windows key, Escape) stop responding, so it feels like you’re stuck inside it.
2. The creepy show
It sets your wallpaper to black and plays a looping full-screen video of a night-time road with unsettling colour effects, while threatening messages appear: “YOU ARE THE NEXT”, “I CAN SEE YOU”, “NOW ITS TOO LATE”, “DONT LOOK BEHIND YOU”. This part is pure theatre, meant to scare you while the real changes happen quietly underneath.
3. The damage underneath
While the video plays, 000.exe quietly makes a series of changes to Windows:
- It closes the Windows desktop and taskbar, so everything disappears except the video.
- It renames your Windows user account to “UR NEXT”.
- It empties your Desktop and fills it with hundreds of files all named “UR NEXT”, plus one long “OPEN ME” file that repeats the threats.
- It disables Task Manager, so you can’t easily see or stop what’s running.
- It sets itself to run again every time Windows starts, so a simple restart doesn’t get rid of it.
- It deletes the folder that holds the built-in Windows Store apps (Photos, Store, Calculator and the rest), breaking them.
4. The reboot
When it’s finished, 000.exe forces your PC to restart. You log back in to a desktop that calls you “UR NEXT”, with your files gone from the desktop and the built-in apps broken, and it may start itself up all over again.
Scarier than it is
000.exe is built to feel like your PC is being destroyed, but it’s much gentler than the ransomware and disk wipers on the rest of this page. It never touches the Master Boot Record, so Windows still starts normally afterwards (there’s no Nyan Cat ending like MEMZ). It doesn’t encrypt anything or ask for money, and it doesn’t steal passwords or send anything over the internet.
What you actually lose is whatever was on your desktop, plus the built-in apps. Annoying, but you can recover from it.
000.exe vs MEMZ
| 000.exe | MEMZ | |
|---|---|---|
| Overwrites the boot record | No | Yes |
| Windows still boots after | Yes | No |
| Deletes your files | Desktop only | No (just the MBR) |
| Main goal | Scare you | Scare you, then brick the PC |
| Can you undo it? | Mostly, by hand | Only by rebuilding the disk |
Both are “joke” viruses from the same YouTube virus-testing scene, and both lean on a big scary show. The difference is the ending: 000.exe leaves you a working (if messy) Windows, while MEMZ leaves you a dead one.
Cleaning it up
Because Windows still boots, you can undo most of it without reinstalling. On a PC you own:
- Start in Safe Mode so the virus doesn’t launch with Windows (hold Shift while clicking Restart → Troubleshoot → Advanced options → Startup Settings → Safe Mode).
- Remove its startup entry so it stops coming back. The leftover file lives in the Windows “Startup” folder; deleting it there stops the loop.
- Turn Task Manager back on. 000.exe flips a single Windows setting to block it; reversing that setting restores it.
- Rename your account back to its real name in Settings, and tidy the “UR NEXT” files off the Desktop.
- Reinstall the built-in apps. A single PowerShell command re-registers the Microsoft Store apps, or you can reset Windows while keeping your files as a last resort.
If that sounds like too much, restore from a backup, or use Windows’ “Reset this PC” and choose to keep your personal files.
And next time a video dares you to run a “cursed” .exe, remember that 000.exe needed you to click Yes on the administrator prompt to do any of this. Some of the files shared in that genre are far nastier than this one.
Sources and more info
- FlyTech Videos: the open-source code and making-of for 000.exe
- 2-Spyware: 000.exe, what it does and how to remove it
- Wikidata: 000.exe
Background: AI-generated illustration made for this page, not a real screenshot.
Comments
Sign in with Discord to leave a comment. Be respectful: spam, insults and malware links are removed.