I recently received a new PC build from a local computer shop. The owner offered to install Windows 11 and update the BIOS, so I accepted. After getting the computer back, I noticed it was running an unofficial Windows 11 Pro installation that was not activated. Several unfamiliar programs also had administrator permissions.
A full scan detected `Trojan:Win32/Commando.Alml` associated with a KMS activation script located under `D:Windows LoaderActivator Win + Office`. I deleted the file and used Windows Reset with the option to remove everything. However, I was not offered the usual choice between cloud download and local reinstall.
After the reset, I signed in with a new email account. The scan was clean, but both Edge and Chrome still opened with Zone94.com as the first tab. I want to completely remove anything the shop installed and reinstall Windows from trustworthy media. Should I wipe the system drive and install Windows 11 directly from Microsoft's official installer? Could this have affected other components such as the SSD, motherboard, RAM, GPU, keyboard, or mouse?
4 Answers
Change passwords from a different trusted device, especially for email, banking, and other important accounts, and enable two-factor authentication. Do not sign into those accounts on the questionable Windows installation. Once the clean install is complete, check browser extensions, startup items, proxy settings, and DNS settings if the redirect somehow remains. If Zone94.com still appears after a genuine clean installation, investigate the router or network settings as well.
The safest approach is a clean installation from official Windows media rather than relying on the reset that was already on the machine. On a separate, trusted computer, download the Windows 11 installer or ISO directly from Microsoft and create a bootable USB drive with a tool such as Rufus. Boot the new PC from that USB, delete the existing partitions on the intended system drive, and install Windows to the unallocated space. Be very careful to select the correct drive if more than one is installed. Afterward, run Windows Update and install drivers only from the motherboard and hardware manufacturers. Back up anything important first, because deleting the partitions will erase the drive.
The detection appears to be connected to a KMS activator used to bypass Windows and Office licensing. That may be a potentially unwanted or unsafe script rather than proof that every component is infected, but the shop's installation is still not trustworthy. The browser redirect is another reason not to keep using that installation. Ask the shop for an explanation and a legitimate Windows license if you paid for one, but I would still perform the clean installation yourself or have them do it while you verify the official media and license.
A normal Windows infection generally affects the operating system and files, not the RAM, GPU, keyboard, mouse, or SSD hardware itself. The motherboard firmware is a separate concern, but simply installing a cracked Windows copy does not normally infect those components. Since the shop also updated the BIOS, check the motherboard manufacturer's support page for the current BIOS version and, if necessary, reflash it using the manufacturer's official instructions. Do not use random BIOS files or utilities.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures