My father opened a ZIP file sent by someone he works with, and shortly afterward his laptop became slow and started behaving strangely. I connected to the computer through remote-access software and found the file he had opened, so I'm concerned it installed a Trojan or other malware. Windows Chrome opens by itself after restarting, and Windows Security is inaccessible.
So far, I have changed the passwords used on the laptop, signed out of email accounts, disabled the Wi-Fi adapter, and run Microsoft's Malicious Software Removal Tool from the command line. The laptop is currently disconnected from the network.
How much damage could have occurred during the 30–45 minutes before we disconnected it? What should I do next? Is it safe to copy personal files to an external SSD before completely resetting and reinstalling Windows, and how can I avoid carrying the malware over?
4 Answers
You can try an offline rescue scan or reputable tools such as Malwarebytes or Dr.Web, but a detection result—or no detection—doesn’t establish that the system is clean. If you need evidence about what happened, stop using the computer and preserve it for professional analysis; otherwise, back up carefully and wipe the drive completely before reinstalling Windows.
Treat the laptop as compromised. Keep it disconnected from Wi-Fi and wired networks, then perform a clean Windows reinstall rather than relying on antivirus to prove that everything is safe. Malware can create scheduled tasks, startup entries, or other persistence that scanners may miss. Back up only essential personal documents, photos, and similar files—not programs, scripts, installers, macros, or unknown files—and scan the backup from a separate, trusted computer before opening anything.
Assume any passwords used on that machine may have been exposed. Changing them was a good first step, but do it again from a known-clean device, starting with email and financial accounts, and enable multifactor authentication wherever possible. Also sign out existing sessions and review account recovery settings and recent login activity.
Once the system is rebuilt, keep a current offline backup and create a known-good system image. Only restore data files that have been scanned, and avoid opening the original ZIP or any suspicious executable again. The fact that Chrome launches on its own and Windows Security cannot be opened makes a full wipe preferable to continued troubleshooting.
A clean reinstall is safer here because the exact Trojan and what it changed are unknown. After reinstalling, fully update Windows and applications before restoring files.