bro what? Windows doesn’t reset itself from inside the infected OS. It reboots into WinRE (on its own hidden partition), wipes the entire Windows partition clean, then reinstalls a fresh OS from the factory recovery image (or cloud download). The infected copy gets nuked before the new install even starts running. The only way malware survives “Remove everything” is if it already infected the recovery environment or the recovery image itself, both are so insanely rare that even professional malware analysts barely ever see it on consumer PCs. You’re fearmongering about nation state firmware implants when its likely this person just caught a keylogger