I accidentally opened an RTF attachment from a suspicious job-related email while checking my school account in Chrome. A window appeared briefly and then closed. I disconnected the laptop from the internet, ran a Microsoft Defender Offline scan, checked for Defender alerts and recent downloads, and didn't find anything obviously suspicious. I also changed my email and school-account passwords from a separate desktop computer. How can I tell whether the file actually did anything, and what steps should I take before reconnecting the laptop?
3 Answers
A full reinstall is usually a last resort rather than the first response to opening one suspicious attachment, especially when an offline Defender scan found nothing. First install pending security updates, run another trusted malware scan, inspect recently created files and startup tasks, and ask school IT to review the email and account activity. If you find signs of persistence, suspicious logins, or detections from multiple scanners, then back up only personal documents and perform a clean Windows installation.
Changing passwords from a separate, trusted computer was the right approach. If you had changed them on the potentially affected laptop, it would be wise to change them again from a clean device, sign out other sessions, enable multifactor authentication, and review recent account sign-ins. Since the password changes were made on your desktop, keep the laptop offline while scanning and updating it.
You’ve already taken several sensible precautions. A window flashing open and closing doesn’t automatically mean malware executed. RTF files are most concerning when they exploit an outdated version of Word or another document reader, so make sure Windows, Office, and your document software are fully updated. As a second opinion, run a reputable on-demand scanner such as Malwarebytes. You can also check Downloads and the temporary-files folder for files created around the time of the incident, then review Startup apps and Task Scheduler for unfamiliar entries. Forward the message to your school’s IT department so they can inspect it and check whether other accounts received it. If those checks are clean, a complete wipe is probably unnecessary.
I kept the laptop disconnected and changed the passwords using my desktop computer, so the accounts should not have been exposed through the laptop while I was doing that.