Run the task manager, and even though it's laborous, check every single running process via the machine that is online. Just google the exe name and look for anything suspicious.
Also: There are a few files that often are infected/lobotomized/duplicated when the pc has been infected: One such file is the rundll32.exe whis is located in the system32 folder. I don't remember what size it's supposed to have, but search for rundll32.exe files on your computer and chech it's only found in the system32 folder, and google it's size.
__________________
Je Suis Charlie
|