That is already a bad sign that the .js file is malware. At this point, I'd skip the upload and run some scans. If they don't flag the file as malware and remove it, post back and let us know.

If you changed your user account to an Administrator account now, or enabled the built-in Administrator account, that might enable any malware to gain more rights. Run scans with your antivirus software and MalwareBytes. Save the logs in case this ends up in Broni's Intensive Care Unit forum.