I received a phishing email that appeared to come from someone I trusted and accidentally downloaded and ran an EXE file. It installed ScreenConnect, a remote-access program. I noticed it after roughly 10 minutes, uninstalled it, disconnected the computer from the internet, and ran both Microsoft Defender Offline and a full Defender scan. Neither scan found anything, and I could not find remaining services, scheduled tasks, or ScreenConnect folders. Would uninstalling the program and running clean scans be enough, or should I completely wipe and reinstall Windows? I am especially concerned about whether the installer could have included persistence, an infostealer, or a keylogger.
4 Answers
A clean Defender scan is reassuring, but it does not prove that only ScreenConnect ran. A customized installer can provide unattended access and may install additional malware or persistence. Run another reputable on-demand scanner, but keep the computer offline while you investigate.
Check Event Viewer under Windows Logs > Application and filter for ScreenConnect events around the time of the incident. The logs may show the software contacting its server, a remote connection, commands being run, or files being transferred. Any evidence of commands or transferred files should be treated seriously because the attacker may have installed something else.
If a full reinstall is not immediately practical, leave the machine disconnected, review Event Viewer, inspect startup items and scheduled tasks, and run a second scanner such as Malwarebytes. However, those checks reduce uncertainty rather than guaranteeing the system is clean; reinstalling is the more dependable answer for a computer used for sensitive accounts.
Because an unknown executable was run and remote-access software was installed, the safest option is to back up only personal documents that you have checked carefully, then wipe the drive and reinstall Windows from official installation media. Afterward, change passwords from a known-clean device, revoke active sessions, and enable MFA. If you find evidence that commands were executed or files were transferred, consider the old system and any credentials used on it compromised.
The absence of a visible connection notification is not conclusive. Some remote-access activity can happen through the backend without an obvious popup, so the logs and the installer itself are more useful evidence.