Malware detected and removed (downloaded file)

A marketing employee downloaded a program that antivirus says is a trojan, a harmful program disguised as something useful. Antivirus removed it. The question is whether it ran first.

Your task: Decide how serious this is. Check where the file came from, whether it ever ran, and whether anyone else got it.