I wanted to remove a probably malicious executable, but instead inadvertently double-clicked on it while using an account with administrative privileges. Nothing visible happened during a few seconds, then the executable removed itself (something a legitimate executable wouldn't probably do).
My next steps were:
- Ensuring Avast definitions are up to date.
- Disconnecting the machine from LAN to avoid affecting other machines.
- Doing a full scan with Avast; this revealed no viruses.
- Checking for suspicious entries with Sysinternals' Autoruns: I don't see anything wrong there.
- Trying to run Sysinternals' RootkitRevealer, but it won't run on Windows 8.
- Runing Sophos Anti-Rootkit and Kaspersky TDSSKiller. No rootkits found (Sophos Anti-Rootkit found a bunch of hidden registry keys and hidden files, but those are likely to be legitimate files).
- Checking services.msc; given the number of services, it's difficult to check if all are legit.
sfc /scannow. Nothing wrong there: "Windows Resource Protection did not find any integrity violations."
- Watching resources usage for a few minutes. Looks like there is nothing exceptional either.
- Checking the list of Chrome extensions. Nothing wrong there. Internet Explorer is not installed, so nothing to check there.
It looks like the PC wasn't infected, but I'm still scared to reconnect it to company domain. I would like to avoid reinstalling Windows, since it would annoy a lot the person using the concerned machine.
What should I try next?