About 000.exe :

Since many viruses are named with random numbers, such as 123.exe, 378.exe, etc., and the most famous of which is 000.exe, which leads many people to see the three zero-named files and think they are Viruses. In fact, to determine whether a file is a virus based on the name, this method is incorrect. To define whether a file is a virus file, it depends on whether it damages the system or steals user data.

However, for this kind of specially named files, of course you must be careful, and it is best to use anti-virus software to check it.

For 000.exe virus, the following phenomena may occur:

000.exe is a virus that runs on Windows systems. After the virus runs, it will tamper with desktop files, user account names and unlimited pop-ups.

When the virus is fully executed, it will terminate the process explorer.exe, and will also attempt to delete the contents of the WindowsApps folder, which contains the installed Windows universal applications (Windows 8 and Windows 10). Then it will play a video in full screen and loop the video clip in the background. There is a ghastly path in the video, and the color of the video will keep changing, from orange, green, black and white, to intense black and white.
During the video playback, the virus will disable the task manager, change the user's Windows account name to "UR NEXT", change the default notepad icon to a custom .ico file, and restart the user's computer after completion.


Next, the desktop wallpaper was changed to pure black, and the desktop was full of "UR NEXT" notepad files. The default notepad icon will become a red square with "UR" and "NEXT", and "UR" will be stacked on top of "NEXT". Open a "UR NEXT" file, and the user will see "UR NEXT" that seems to have unlimited lines.

When the system is running, there will be a dialog box containing a "run away" message, followed by a "run away" button. However, a new dialog box with the same message appears every second. Click the run away button to close the dialog.

Solution to 000.exe:

1. Stop unlimited popups

Right-click the start menu and click "Command Prompt (Administrator)" (it must be started with administrator authority, and CMD can be started directly if UAC is closed). After opening the command prompt, enter: taskkill /f /im conhost.exe and press Enter; all pop-up windows can be closed at this time. Open the command prompt again, enter: taskkill /f /im runaway.exe and press Enter (this step ends the virus body)


2. Delete all files created by the virus on the desktop

Open a command prompt (administrator) and enter the following commands in sequence
cd %USERPROFILE%\Desktop (Enter the desktop of the current user)
del UR*.txt (match all txt files starting with UR and delete)
del OPENME*.rtf (match all rtf files at the beginning of OPENME and delete)


3. Change the wallpaper back

Right-click on a blank space on the desktop, "Personalization"-"Background"-"Background", change "Pure Color" to "Wallpaper", and choose a wallpaper you like.

4. Recover the locked task manager

Save the following content as a file in .reg format and open it to unlock the task manager:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=-

5. Remove the virus startup items

Start the task manager, click "details" to expand the task manager. Switch to the startup tab, you can find the virus startup item rniw.exe. Right-click rniw.exe and click "Open File Location". Delete it when found; click WIN+R to open the Run window, type %temp% and press Enter to open the temporary folder to clean up the virus residue.

6. Repair the damaged default icon of txt text file format

Start the registry editor, locate HKEY_CLASSES_ROOT\txtfile\DefaultIcon, modify the default key value to "%SystemRoot%\system32\imageres.dll, -102", and close the registry editor.

7. Change back to the tampered username

Right-click the start menu - Control Panel - "Programs" - Change account type - double-click your own account - change the account name to your favorite name.