Malware · Trojan

000.exe Looks Like the End of Your PC. It’s Mostly a Prank.

000.exe

000.exe is the virus that looks like the end of the world and turns out to be a prank. It fills your screen with a creepy video and messages telling you “YOU ARE THE NEXT”, renames your Windows account to “UR NEXT”, wipes your desktop and reboots your PC. It’s terrifying the first time you see it, but unlike MEMZ it never actually kills Windows, and almost everything it does can be undone.

Don’t run 000.exe on a PC you care about. It deletes your desktop files, breaks the built-in Windows apps and changes system settings. It won’t destroy Windows like MEMZ, but cleaning it up by hand is a pain. Everything here is for education, and any test should be done in a virtual machine you’re ready to throw away. See how I test malware safely.

A creepypasta with real code

000.exe was made in 2016 by the YouTuber FlyTech Videos, who built joke viruses to test on camera. It was designed in the style of a creepypasta: a scary internet story. The idea was that you’d find a mysterious file called 000.exe, run it out of curiosity, and get jump-scared. It spread the way creepypastas do, through “I ran the scariest virus” reaction videos, and became one of the most recognisable prank viruses on YouTube.

Unlike most malware, 000.exe isn’t a secret. A few years later FlyTech published the full source code openly along with a “making-of” video, treating it as a joke and a teaching example rather than a real weapon. That’s why we know exactly what it does, step by step, and why it’s safe to write about in detail.

What happens when you open it

1. It traps you on the screen

The moment you open it, 000.exe goes full-screen and starts swallowing your keyboard shortcuts. The usual escape routes (Alt+Tab, the Windows key, Escape) stop responding, so it feels like you’re stuck inside it.

2. The creepy show

It sets your wallpaper to black and plays a looping full-screen video of a night-time road with unsettling colour effects, while threatening messages appear: “YOU ARE THE NEXT”, “I CAN SEE YOU”, “NOW ITS TOO LATE”, “DONT LOOK BEHIND YOU”. This part is pure theatre, meant to scare you while the real changes happen quietly underneath.

3. The damage underneath

While the video plays, 000.exe quietly makes a series of changes to Windows:

  • It closes the Windows desktop and taskbar, so everything disappears except the video.
  • It renames your Windows user account to “UR NEXT”.
  • It empties your Desktop and fills it with hundreds of files all named “UR NEXT”, plus one long “OPEN ME” file that repeats the threats.
  • It disables Task Manager, so you can’t easily see or stop what’s running.
  • It sets itself to run again every time Windows starts, so a simple restart doesn’t get rid of it.
  • It deletes the folder that holds the built-in Windows Store apps (Photos, Store, Calculator and the rest), breaking them.

4. The reboot

When it’s finished, 000.exe forces your PC to restart. You log back in to a desktop that calls you “UR NEXT”, with your files gone from the desktop and the built-in apps broken, and it may start itself up all over again.

Scarier than it is

000.exe is built to feel like your PC is being destroyed, but it’s much gentler than the ransomware and disk wipers on the rest of this page. It never touches the Master Boot Record, so Windows still starts normally afterwards (there’s no Nyan Cat ending like MEMZ). It doesn’t encrypt anything or ask for money, and it doesn’t steal passwords or send anything over the internet.

What you actually lose is whatever was on your desktop, plus the built-in apps. Annoying, but you can recover from it.

000.exe vs MEMZ

000.exeMEMZ
Overwrites the boot recordNoYes
Windows still boots afterYesNo
Deletes your filesDesktop onlyNo (just the MBR)
Main goalScare youScare you, then brick the PC
Can you undo it?Mostly, by handOnly by rebuilding the disk

Both are “joke” viruses from the same YouTube virus-testing scene, and both lean on a big scary show. The difference is the ending: 000.exe leaves you a working (if messy) Windows, while MEMZ leaves you a dead one.

Cleaning it up

Because Windows still boots, you can undo most of it without reinstalling. On a PC you own:

  1. Start in Safe Mode so the virus doesn’t launch with Windows (hold Shift while clicking Restart → Troubleshoot → Advanced options → Startup Settings → Safe Mode).
  2. Remove its startup entry so it stops coming back. The leftover file lives in the Windows “Startup” folder; deleting it there stops the loop.
  3. Turn Task Manager back on. 000.exe flips a single Windows setting to block it; reversing that setting restores it.
  4. Rename your account back to its real name in Settings, and tidy the “UR NEXT” files off the Desktop.
  5. Reinstall the built-in apps. A single PowerShell command re-registers the Microsoft Store apps, or you can reset Windows while keeping your files as a last resort.

If that sounds like too much, restore from a backup, or use Windows’ “Reset this PC” and choose to keep your personal files.

And next time a video dares you to run a “cursed” .exe, remember that 000.exe needed you to click Yes on the administrator prompt to do any of this. Some of the files shared in that genre are far nastier than this one.

Sources and more info

Background: AI-generated illustration made for this page, not a real screenshot.

← Back to Malware

Comments

Sign in with Discord to leave a comment. Be respectful: spam, insults and malware links are removed.