Skip to content

Commit 1951f6f

Browse files
ArsenTechArsenTech
committed
Added 000.exe removal post
1 parent 1b5130a commit 1951f6f

File tree

7 files changed

+183
-13
lines changed

7 files changed

+183
-13
lines changed

‎src/app/categories/[category]/page.tsx‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,15 +80,14 @@ export default async function CategoriesPage({params, searchParams}: PageProps){
8080
const postsPerPage = pageSize ? parseInt(pageSize) : POSTS_IN_SEARCH;
8181
const categoryDecoded = decodeURIComponent(category);
8282
const results = await getPostsByCategory(categoryDecoded)
83-
const totalPages = Math.ceil(results.length / postsPerPage)
8483
return (
8584
<PageLayout>
8685
<Search
8786
mode="category"
8887
pageSize={postsPerPage}
8988
category={categoryDecoded}
9089
results={results}
91-
totalPages={totalPages}
90+
totalPages={results.length}
9291
currentPage={currentPage}
9392
/>
9493
</PageLayout>

‎src/app/page.tsx‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,13 @@ export default async function Home({searchParams}: HomepageProps) {
1212
const postsPerPage = pageSize ? parseInt(pageSize) : POSTS_PER_PAGE;
1313
const posts = await getAllPosts();
1414
const categories = await getCategories(posts);
15-
const totalPages = Math.ceil(posts.length / postsPerPage)
1615
return (
1716
<PageLayout>
1817
<LandingPage
1918
pageSize={postsPerPage}
2019
posts={posts}
2120
currentPage={currentPage}
22-
totalPages={totalPages}
21+
totalPages={posts.length}
2322
categories={categories}
2423
query={query || ""}
2524
/>

‎src/posts/linux-terminal-customization.mdx‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ Open the preferred terminal, then run:
2828
<CMDBlock
2929
shell="bash"
3030
data={{
31-
Debian: "sudo apt-get install fish",
32-
"Debian (Alt Method)": "sudo apt install fish",
31+
"Debian (apt-get)": "sudo apt-get install fish",
32+
Debian: "sudo apt install fish",
3333
Arch: "sudo pacman -S fish",
3434
Fedora: "sudo dnf install fish"
3535
}}
@@ -155,8 +155,8 @@ Run the following command to install neofetch:
155155
<CMDBlock
156156
shell="bash"
157157
data={{
158-
Debian: "sudo apt-get install neofetch",
159-
"Debian (Alt Method)": "sudo apt install neofetch",
158+
"Debian (apt-get)": "sudo apt-get install neofetch",
159+
Debian: "sudo apt install neofetch",
160160
Arch: "sudo pacman -S neofetch",
161161
Fedora: "sudo dnf install neofetch"
162162
}}

‎src/posts/remove-000-exe.mdx‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
---
2+
title: "How to Remove The 000.exe Virus"
3+
description: "This guide will help you remove the 000.exe virus without any antivirus software or any help on your infected Windows PC. You'll learn to fix MBR corruptions after reading the post"
4+
date: "2025-11-26"
5+
tags: ["000.exe", "malware", "remove 000.exe", "delete 000.exe", "computer virus", "000.exe removal", "000.exe malware", "how to remove the 000.exe", "how to delete the 000.exe"]
6+
published: true
7+
featured: false
8+
categories: ["Malware Removal", "Windows", "Cybersecurity", "Troubleshooting", "Bootable USB"]
9+
author: ArsenTech
10+
authorURL: https://github.com/ArsenTech
11+
---
12+
## Introduction
13+
Got infected by **000.exe** and can't figure out how to remove it?
14+
This guide will help you get rid of that malware on any Windows computer — **without antivirus software or outside help**.
15+
16+
000.exe is not as destructive as deep ransomware or MBR malware.
17+
It mainly:
18+
- Spams **runaway message boxes**
19+
- Creates junk files
20+
- Edits small registry values
21+
- Changes your wallpaper
22+
- Drops startup entries
23+
24+
Your **data and bootloader are safe**, only cosmetic and annoying changes are made.
25+
26+
> [!WARNING]
27+
> Do not download malware or execute unknown scripts on a real machine.
28+
> All demonstrations on ArsenTech are performed inside isolated virtual machines.
29+
> Readers should follow the tutorial carefully and fully understand the steps before removing malware.
30+
31+
If you prefer watching instead of reading, here's the full video guide: [Watch the video on YouTube](https://youtu.be/OAXdCbtfWm4)
32+
33+
## Step 1 - Stopping the Message Boxes
34+
000.exe spams message boxes every millisecond, making your PC unusable.
35+
36+
### 1. Stop CMD-based popups
37+
Open Command Prompt as Administrator and type:
38+
```cmd
39+
taskkill /f /im cmd.exe
40+
```
41+
This stops the chained message box commands.
42+
43+
### 2. Stop the main spammer executable
44+
Open Command Prompt as Administrator again:
45+
```cmd
46+
taskkill /f /im runaway.exe
47+
```
48+
This immediately kills the process responsible for generating thousands of popups.
49+
50+
> [!NOTE]
51+
> `runaway.exe` is an executable dropped by 000.exe to repeatedly launch spam message boxes.
52+
53+
Once finished, your desktop should be clean and usable.
54+
55+
## Step 2 - Delete Files Planted by 000.exe
56+
000.exe creates `.txt` and `.rtf` files on the desktop named `UR NEXT`
57+
58+
To delete all of them at once, press:
59+
<KbdGroup>
60+
<Kbd>Ctrl</Kbd>
61+
<span>+</span>
62+
<Kbd>A</Kbd>
63+
</KbdGroup>
64+
to select all files on your desktop. Then permanently delete them:
65+
<KbdGroup>
66+
<Kbd>Shift</Kbd>
67+
<span>+</span>
68+
<Kbd>Del</Kbd>
69+
</KbdGroup>
70+
71+
Empty your Recycle Bin afterward. This removes all visible leftovers from the malware.
72+
73+
## Step 3 - Restore Your Theme & Desktop Background
74+
000.exe replaces your wallpaper and UI theme to make your system look corrupted or hacked.
75+
To restore your theme:
76+
1. Open **Settings**
77+
2. Go to **Personalization → Themes**
78+
3. Choose your preferred theme
79+
4. Reapply your desktop background
80+
81+
Your system should now visually return to normal.
82+
83+
## Step 4 - Registry changes
84+
> [!CAUTION]
85+
> Only modify the registry keys shown below. Editing unrelated values may corrupt Windows and cause boot failure.
86+
87+
Open the run command by pressing the following keys:
88+
<KbdGroup>
89+
<Kbd>⊞</Kbd>
90+
<span>+</span>
91+
<Kbd>R</Kbd>
92+
</KbdGroup>
93+
And type `regedit`. If prompted, click **Yes**.
94+
95+
### Registry Change 1 - Enable Task Manager
96+
Navigate to:
97+
```
98+
HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Policies/System
99+
```
100+
And delete `DisableTaskMgr`
101+
102+
### Registry Change 2 - Change the Icon of the Text files
103+
Navigate to:
104+
```
105+
HKEY_CLASSES_ROOT/txtfile/DefaultIcon
106+
```
107+
Change the **(Default)** entry:
108+
| Before | After |
109+
| ------------------------------------------------- | --------------------------------------- |
110+
| `C:\Users\<username>\AppData\Local\temp\icon.ico` | `C:\Windows\system32\imageres.dll,-102` |
111+
112+
This will change the text icon back to the original place. It'll take effect after restart.
113+
114+
## Step 4 - Removing Startup Apps
115+
Open the file explorer and navigate to:
116+
```
117+
%programdata%/Microsoft/Windows/Start Menu/Programs/Startup
118+
```
119+
and delete `rniw.exe`
120+
121+
> [!NOTE]
122+
> `rniw.exe` is an executable planted by 000.exe to spam message boxes every millisecond.
123+
124+
## Step 5 - Removing Temporary files
125+
Open the Run dialog:
126+
<KbdGroup>
127+
<Kbd>⊞</Kbd>
128+
<span>+</span>
129+
<Kbd>R</Kbd>
130+
</KbdGroup>
131+
132+
Type `%temp%`, and clear every single temporary file in this folder.
133+
134+
## Step 6 - Changing the username back.
135+
Open the Run dialog:
136+
<KbdGroup>
137+
<Kbd>⊞</Kbd>
138+
<span>+</span>
139+
<Kbd>R</Kbd>
140+
</KbdGroup>
141+
142+
Type `control`. Go to:
143+
```
144+
User Accounts → User Accounts
145+
```
146+
Change your account name back to the preferred name.
147+
148+
Now Restart your PC.
149+
150+
## Conclusion
151+
And that's it! 000.exe has been completely removed from your system.
152+
This malware modifies registry entries, themes, user accounts, wallpapers, and core Windows settings, so restoring everything manually is critical.
153+
154+
To prevent future infections:
155+
- Delete suspicious `.exe` files immediately
156+
- Never run unknown programs
157+
- Use a stronger antivirus
158+
- Keep real-time protection enabled
159+
- Always use a virtual machine for malware testing
160+
- Follow safe browsing habits & avoid unknown downloads
161+
162+
Thanks for reading! If you want more malware removal guides and educational malware tests, check out my YouTube channel!
163+
164+
> GitHub [@ArsenTech][github-url] &nbsp;&middot;&nbsp;
165+
> YouTube [@ArsenTech][yt-url] &nbsp;&middot;&nbsp;
166+
> Patreon [ArsenTech][patreon-url] &nbsp;&middot;&nbsp;
167+
> [ArsenTech's Website][website-url]
168+
169+
[yt-url]:https://www.youtube.com/channel/UCrtH0g6NE8tW5VIEgDySYtg
170+
[patreon-url]:https://www.patreon.com/ArsenTech
171+
[github-url]: https://github.com/ArsenTech
172+
[website-url]: https://arsentech.github.io

‎src/posts/remove-memz.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ date: "2025-11-26"
55
tags: ["memz trojan", "malware", "memz", "remove memz trojan", "delete memz trojan", "memz trojan removal", "memz trojan malware", "remove memz", "delete memz", "memz removal", "computer virus", "how to remove the memz trojan", "how to delete the memz trojan"]
66
published: true
77
featured: false
8-
categories: ["Malware Removal", "Windows", "Cybersecurity", "Troubleshooting"]
8+
categories: ["Malware Removal", "Windows", "Cybersecurity", "Troubleshooting", "Bootable USB"]
99
author: ArsenTech
1010
authorURL: https://github.com/ArsenTech
1111
---

‎src/posts/remove-noescape.mdx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ date: "2025-11-26"
55
tags: ["noescape", "malware", "noescape.exe", "remove noescape", "delete noescape", "noescape removal", "noescape malware", "remove noescape.exe", "delete noescape.exe", "noescape.exe removal", "computer virus", "how to remove noescape", "how to delete noescape", "how to get rid of noescape"]
66
published: true
77
featured: false
8-
categories: ["Malware Removal", "Windows", "Cybersecurity", "Troubleshooting"]
8+
categories: ["Malware Removal", "Windows", "Cybersecurity", "Troubleshooting", "Bootable USB"]
99
author: ArsenTech
1010
authorURL: https://github.com/ArsenTech
1111
---
@@ -134,14 +134,14 @@ Remove these modifications:
134134
### Registry Change 7 - Re-enable Registry Editing (UAC Policies)
135135
Navigate to:
136136
```
137-
HKCU/Software/Microsoft/Windows/CurrentVersion/Policies/System
137+
InfectedPCUser/Software/Microsoft/Windows/CurrentVersion/Policies/System
138138
```
139139
And Delete `DisableRegistryTools`. This re-enables Regedit on the repaired system.
140140

141141
### Registry Change 8 - Re-enable Command Prompt
142142
Navigate to:
143143
```
144-
HKCU/Software/Policies/Microsoft/Windows/System
144+
InfectedPCUser/Software/Policies/Microsoft/Windows/System
145145
```
146146
And delete `DisableCMD`. This restores access to CMD on the infected user account.
147147

‎src/posts/remove-petya-ransomware.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ date: "2025-11-26"
55
tags: ["ransomware", "petya", "remove ransomware", "delete ransomware", "ransomware removal", "remove petya", "delete petya", "petya removal", "computer virus", "how to remove the ransomware", "how to delete the ransomware", "malware"]
66
published: true
77
featured: false
8-
categories: ["Malware Removal", "Windows", "Cybersecurity", "Troubleshooting"]
8+
categories: ["Malware Removal", "Windows", "Cybersecurity", "Troubleshooting", "Bootable USB"]
99
author: ArsenTech
1010
authorURL: https://github.com/ArsenTech
1111
---

0 commit comments

Comments
 (0)