A file called 000.exe is not enough information to identify a virus. The same is true of an EXE with a much longer string of zeros. A file can be renamed, and different programs can share a filename. If you did not expect the file, do not run it just to see what it does.
Last updated:
Does the name prove that it is malware?
No. The .exe extension is used for Windows executable files; it does not prove what a particular file contains or whether it is trustworthy. Its source, the actual file contents and security-tool findings matter more than a scary name or a video showing a file with the same name.
A screenshot of pop-ups, a renamed account or a strange desktop is not proof that your copy will behave the same way. Treat an unexpected executable as a file to check, rather than trying to reproduce an online demonstration.
What should you do first?
| Situation | Useful next step |
|---|---|
| You downloaded it but have not opened it | Leave it unopened and scan the file or its folder. |
| Your antivirus blocked it | Review the alert and leave the file blocked while you check it. |
| You already ran it | Stop using it and scan the PC. If harmful activity is continuing, disconnect it from the network and seek help. |
| You only saw the name in a video | There is no reason to download a copy for a test on your normal PC. |
Scan the file and the computer
- Open Windows Security > Virus & threat protection.
- Check for security-intelligence updates if offered.
- Open Scan options. A custom scan can check a selected file or folder without opening the program.
- If you have already run the file or suspect a wider infection, run the appropriate full scan and follow the security app’s instructions.
- Read the detection and action reported by the security tool.
Microsoft‘s scan-options guide explains these choices. Its antivirus FAQ recommends a full scan when you think the PC is infected. A clean result is useful information, but no single scan is a promise that every possible threat has been ruled out.
When to use Microsoft Defender Offline
If you are worried about persistent malware, Windows Security offers Microsoft Defender Antivirus (offline scan) under Scan options. Save open work before starting: the PC restarts and runs the scan in the Windows Recovery Environment.
After Windows starts again, open Protection history to see the result. Our quick, full and offline scan comparison explains how these scan types differ. An offline scan is a tool for checking the device; it is not a special guaranteed cure for every file named 000.exe.
Remove a detected threat without restoring it
Follow the antivirus app’s action for the detected item, such as quarantine or removal. In Windows Security, review Protection history for the detection and its status. Do not select Allow or Restore simply to make the warning disappear.
If the threat returns, security tools will not open or important settings have changed, get help from a trusted support provider. Repeatedly deleting a filename or returning to an earlier restore point is not proof that the computer is clean.
How to avoid another unknown installer
Use the software maker’s official download or a trusted store, and keep Windows and your browser supported and updated. If you are installing several common Windows apps, our Ninite guide explains its selected-app catalog and update limits. No download tool removes the need to check what you intended to install.