Geekom’s Official Mini PC Driver Archive Contained a Malware-Flagged LAN Installer

A Reddit user first raised the alarm about a Geekom driver archive. VideoCardz independently downloaded the package from Geekom’s website on August 15, 2026, and found the same executable inside it. Geekom later acknowledged that the file had been hosted on its support infrastructure, apologized, and removed the affected legacy resources.

The available evidence supports treating the installer as unsafe, but it does not establish that Geekom deliberately distributed malware, how the file reached the company’s servers, how many people ran it, or what it did on victims’ systems.

The file at the center of the report

The executable was named:

Install_PCIE_Win11_11.10.0720.2022_11222022.exe

It was located in the LAN-driver folder of a shared archive intended for six AMD-based Geekom mini PC families:

• A7
• A8
• AE7
• AE8
• AX7 Pro
• AX8 Pro

The archive was not simply flagged by one antivirus product. VideoCardz checked the file with FileScan.IO, MetaDefender, and VirusTotal, while YARAify reported ClamAV detections including Malware.Agentb and two Asruex-related signatures, one labeled Win.Trojan.Asruex. Reports associated with the same file hash dated back to December 2024.

Multiple detections are enough reason not to execute the installer, although scanner results alone do not prove the file’s complete behavior or rule out every possibility of a false positive. The available reporting did not establish a victim count or provide a full technical analysis of what happened after execution.

Why running the installer could be serious

A driver installer typically needs administrator-level permissions. If the flagged executable were malicious, that level of access could allow code to make privileged system changes and potentially expose data or install additional components. Tom’s Hardware specifically warned that malware embedded in a driver installer could receive administrator-level permissions.

That is a risk assessment, not evidence that this particular file carried out every possible action. Users should therefore avoid testing it themselves, even on a spare system.

Geekom’s explanation

Geekom said the installer remained available on an outdated support page after the company replaced its older support system with a newer one. Although the page was no longer part of the site’s normal navigation, the legacy resource remained reachable through links indexed by search engines.

The company said its review found no comparable anomaly on the current driver pages. It also said the issue did not affect Geekom hardware or the Windows operating system pre-installed on its mini PCs. Geekom said it was removing the legacy files and pages and tightening its resource-management and review procedures.

Geekom also asked VideoCardz to consider removing its original report. VideoCardz declined, arguing that its central claim was correct: the file had been downloadable from Geekom’s own infrastructure and the company had confirmed that fact.

One important question remains unanswered: Geekom has not explained how the malware-flagged executable entered the archive or remained available on its servers. The company’s legacy-page explanation describes why the file was still reachable, but not its original provenance.

What affected users should do

If you have downloaded the archive or still have the installer, Geekom’s guidance is straightforward:

1. Do not run the executable. Delete any local copy that has not been executed.
2. Scan the computer with Windows Security, Microsoft Defender, or another trusted antimalware tool if the file was downloaded or run.
3. Replace the network driver using Windows Update, the component vendor’s official source, or Geekom’s current support pages rather than the legacy archive.
4. Consider a clean Windows installation if the installer was executed or if you want the most conservative response. Tom’s Hardware recommended a full system wipe where possible, with an offline Defender scan as a minimum precaution.

The safest distinction is between downloading the archive and executing the installer. A downloaded file can be removed without proving that the system was compromised; execution is the event that could have granted the installer elevated access.

How this differs from the AceMagic incident

The Geekom case concerns a downloadable executable inside a legacy LAN-driver archive. It is not the same as an incident involving malware in a factory-installed Windows image: the available reporting specifically says Geekom’s pre-installed operating system was not affected.

That difference matters for assessing exposure. Geekom users who never downloaded or ran the old driver installer were not shown by the supplied reporting to have received the flagged file through the machine’s pre-installed Windows environment. Users who did execute it should take the stronger scanning and reinstall precautions above.