I recently had a new PC assembled by a local computer shop. The owner offered to install Windows 11 and update the BIOS, so I agreed. When I got the computer back, I found an unofficial Windows 11 Pro installation that was not activated, along with several unfamiliar programs having administrator permissions.
A full scan detected Trojan:Win32/Commando.Alml. The affected command referenced a KMS activation script in a folder called "Windows Loader" and appeared to be used for activating Windows and Office. I deleted the file and used Windows Reset with the option to remove everything, but I was not offered the usual Cloud download or Local reinstall choices.
After the reset, I signed in with a new email account and ran another full scan, which found nothing. However, Microsoft Edge still opened with Zone94.com as the first tab, making me worry that something survived the reset or that the browser settings were changed again.
I want to start over with a completely trustworthy Windows installation. What is the safest way to wipe the drive and reinstall Windows from official media? Could this have affected components such as the SSD, motherboard, RAM, graphics card, keyboard, or mouse?
4 Answers
Your RAM, GPU, keyboard, mouse, and other ordinary components are very unlikely to be permanently affected by this kind of Windows malware. The main concern is the software on the storage drive. BIOS or firmware tampering is much less common, but since the shop handled the BIOS, you can verify that the motherboard is running the latest firmware downloaded directly from its manufacturer and review the BIOS settings. If you are uncomfortable doing that, ask the shop for an explanation or have another reputable technician inspect it.
The detection is consistent with a cracked KMS activator used to bypass Windows or Office licensing. That does not prove every part of the system is infected, but it is enough reason not to trust the installation. The unexpected browser page may have been added by the same script or by a browser policy or extension, and removing one file or running Reset may not remove everything. A fresh installation from official media is the right fix. Also check Edge and Chrome extensions, startup items, proxy settings, and browser policies after reinstalling.
If you paid for a legitimate Windows license, ask the shop for the product key or a refund and request that they correct the installation. Do not use the activator again. Windows can be reinstalled without entering a key and activated later with a genuine digital license or product key. Keep records of what the shop installed, and consider returning the machine if they refuse to provide a trustworthy installation.
The safest approach is a clean installation, not the built-in reset. On a different trusted computer, download the official Windows 11 installer from Microsoft and create a bootable USB drive of at least 8 GB. Boot the affected PC from that USB, choose a custom installation, and delete all partitions on the target system drive before installing Windows into the unallocated space. Be very careful to select the correct drive if more than one is installed. Afterward, run Windows Update and install drivers only from the motherboard and hardware manufacturers. Change passwords that were used on the old installation, especially email and financial accounts, using another trusted device.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures