Check this first
The short answer
Unauthorized remote actions, unfamiliar successful sign-ins or messages, and unexplained security changes warrant attention. Slowness, cursor movement or a warning alone do not prove compromise. If someone is actively controlling the PC or you granted access to a suspicious caller, disconnect its network first and protect accounts from a separate trusted device.
- Unauthorized control or access granted to a suspicious caller: disconnect Ethernet and Wi-Fi and record actions/time.
- Unfamiliar sign-ins, messages or purchases: review and secure the service from a trusted device through its official site.
- Only a warning or slowness: use the table to distinguish a scam display, device issue and suspected malware.
Five concerning signs—and symptoms that do not prove compromise
These signs call for checking actions, accounts and security records. Counting them is not an infection test.
- Actions continue without your permission: Typing, launching apps or sending messages is different from cursor drift alone. Disconnect the network if the activity is suspicious.
- A suspicious caller was allowed remote access: You shared a connection number or approved control. Legitimate tools can be misused, so no antivirus detection does not establish safety.
- Unfamiliar successful sign-ins, messages or purchases: Compare times and operations in the official service’s records. This can indicate account compromise without proving malware on this PC.
- Protection or recovery settings change unexpectedly: Check disabled protection and unfamiliar recovery contacts against your own actions or an administrator’s authorized settings.
- Files become unusable and a ransom is demanded: Treat this as suspected ransomware: isolate connections and storage and contact the administrator or official specialist/police support.
Slowness, fan noise, cursor movement and browser warnings alone do not establish compromise. No obvious symptoms or no scan detections also do not prove that no access occurred.
Official guidance behind these checks:
Choose your next check
Start with the row that matches your situation. Change one setting at a time so you can tell what helped.
| What you see | What to compare | Go to |
|---|---|---|
| Typing, app actions or messages continue without you | Exclude expected family/support access; isolate suspicious access before scanning. | Step 1 |
| You gave a caller a remote-access code or approval | Record actions, installed names and time; uninstalling alone does not establish safety. | Step 1 |
| Unfamiliar successful sign-in, message or purchase | Use the official service rather than email links; separate account and device compromise. | Step 2 |
| A screen or voice says infected and asks you to call | Distinguish a browser display from Windows Security detection. Do not call the displayed number. | Step 3 |
| Unfamiliar remote app or extension | Check publisher, timing and authorized installation; a name alone does not prove malice. | Step 4 |
| Only slowness, fan activity or cursor movement | Updates, workload or input devices may explain it; check for accompanying unauthorized actions. | Step 5 |
| Defender detects a threat or protection changes unexpectedly | Record name, target, time and status; check administrator/third-party antivirus management. | Step 6 |
| Encrypted files and a ransom demand | Disconnect network and external storage; contact official support before payment or deletion. | Step 7 |
Check in this order
Continue this issue
Private notes stay in this browser. Nothing is sent automatically. Back up important notes on My Page. PC settings are never changed by this site.
Step 1: Disconnect the network if remote activity is suspicious
- Unplug Ethernet from the PC. Turn Wi-Fi off through Windows + A quick settings or Settings → Network & internet → Wi-Fi. Disconnect both if both are in use.
- If possible, use a phone to photograph the screen, time, caller’s contact details and installed software name. Do not delay disconnection to take photos, and avoid passwords or verification codes in images.
- Do not sign in to email, banking, Steam or other accounts on the suspect PC. Use a separate trusted device and connection for Step 2.
- For a work or school PC, contact the administrator after isolation. Preserve it for investigation; do not independently uninstall apps, reset it or clear logs.
What the result means and what to do next
| Situation | What it tells you | Next action |
|---|---|---|
| The actions stop after disconnection | Network access may be involved, but this does not prove the mechanism or damage scope. | Do not reconnect as a test. Protect accounts and inspect installation history. |
| Only cursor movement continues while disconnected | Input devices or local activity may contribute. Isolation does not remove malware. | Use Step 5; if suspicious remote access was granted, Step 7 still applies. |
| You cannot disconnect or file damage continues | Normal Settings actions are insufficient. | Contact the administrator/specialist from another device. If a personal PC has no other way to stop ongoing harm, powering off may be necessary, but can lose unsaved work and investigation evidence. |
- Expected result or what you learned
- The suspect PC is isolated and you can seek help from another device.
- If something is wrong or unclear
- Disconnection does not establish that no data was exposed or account accessed.
- How to undo changes
- Keep it disconnected until a recovery and safety-check plan is agreed. Do not grant the suspicious person access again.
Step 2: Review and protect accounts from a trusted device
- Use a phone or other device not suspected of compromise. Open the official app or your own bookmark, avoiding links in warning emails.
- For a Microsoft account, open its official account security area and sign-in activity. Compare time, success/failure, device and operation with your own use. Location alone does not establish unauthorized access.
- For unfamiliar successful access, changes or messages, follow the service’s official recovery guidance and use a unique password. Review recovery email/phone and multifactor authentication, plus unfamiliar email forwarding or connected apps.
- Use the service’s session-revocation or sign-out-everywhere control too. Microsoft’s option is in Advanced security options → Sign out everywhere; it can take up to 24 hours and excludes Xbox consoles. If locked out, use official account recovery.
- For unauthorized payments, contact the bank/card provider promptly using its official app or the number on your card. A password change does not cancel a payment.
What the result means and what to do next
| Situation | What it tells you | Next action |
|---|---|---|
| Only failed attempts from unfamiliar locations | Attempted access differs from successful access. | Check successful operations and security changes; stop password reuse and enable multifactor authentication. |
| Unfamiliar successful sign-in or recovery-contact change | Account compromise is a serious concern; PC malware remains a separate question. | Use recovery, password change and session revocation; also inspect the PC in Steps 4 and 6. |
| Location differs but time, device and action match your use | Network routing or IP geolocation may explain the location. | Compare other changes and messages instead of deciding from the map alone. |
- Expected result or what you learned
- Recovery contacts and sessions have been reviewed and official protection/recovery actions are underway.
- If something is wrong or unclear
- If suspicious messages continue after a password change, review forwarding, connected apps and remaining sessions with the service’s support.
- How to undo changes
- Do not restore a possibly exposed password or save new passwords/recovery codes on the suspect PC.
Step 3: Separate a fake browser warning from a security detection
- Do not obey demands to call immediately or pay to prevent damage. A real company logo or alarm sound does not authenticate a warning.
- If you have not installed software, granted remote access or entered credentials, open Task Manager with Ctrl + Shift + Esc, select only the browser showing the warning and choose End task. Unsaved browser work can be lost.
- When reopening the browser, do not restore the warning tab. For recurring notifications, review website notification permissions and extensions in the browser.
- If you already granted remote access, closing the warning is insufficient: use Steps 1, 2 and 7. If you entered a password, use Step 2 as well.
- To inspect actual detections, open Windows Security from Start and review Protection history, rather than using a button inside the warning.
- Expected result or what you learned
- Closing the browser stops that display. Merely seeing a warning does not establish that the PC was taken over.
- If something is wrong or unclear
- Persistent activity outside the browser, installed software, remote access or payment needs the relevant response and support branches.
- How to undo changes
- Do not reopen suspicious tabs or restore revoked notification permissions.
Step 4: Identify remote software and extensions and why they were added
- Open Settings → Apps → Installed apps and record names, publishers and dates. Dates can change with updates, so they are not proof of original installation. Check whether family support or an administrator installed it legitimately.
- Open Extensions from the browser’s menu and inspect unfamiliar additions and permissions. On a personal PC, record a suspicious extension, disable it and consult the browser’s official removal instructions.
- If you identify the remote tool a suspicious person instructed you to install on your personal PC, preserve its details and use its Installed apps menu → Uninstall. Let the administrator handle organization software.
- Some remote tools run without appearing in Installed apps. Not finding one does not establish absence. Antivirus may not remove legitimate remote software simply because someone misused it.
- Expected result or what you learned
- You can describe who introduced the tool, its purpose and whether suspicious access was granted.
- If something is wrong or unclear
- If the actions or software name remain unknown, use Step 7 rather than repeatedly deleting apps.
- How to undo changes
- Ask the administrator before restoring a mistakenly disabled business tool. Do not restore access settings or approval for an abused connection.
Step 5: For slowness or cursor movement alone, compare ordinary causes
- If suspicious remote access was granted, this comparison does not clear the PC: use Step 7. For cursor movement alone, disconnect external mice/controllers one at a time and compare.
- Open Task Manager → Processes and inspect CPU, Memory and Disk alongside your updates, games and backups. An unfamiliar process name or high utilization alone does not establish malware; do not delete system files.
- Separate slowness or movement that stops with a device disconnected from unsolicited typing, sending and security changes. For those unauthorized actions, return to Step 1.
- If a suspicious download was executed or other unexplained changes occurred, use Step 6. Improvement of an input-device symptom does not resolve unfamiliar account activity; still use Step 2.
- Expected result or what you learned
- You can identify whether device removal or completion of ordinary background work changes the symptom.
- If something is wrong or unclear
- If unclear, record time, symptoms and recent changes for scanning or manufacturer support.
- How to undo changes
- Reconnect only understood input devices as needed. Do not reconnect the network while suspicious activity continues.
Step 6: Run appropriate Windows scans and read the action status
- These are personal-PC checks. Follow administrator instructions when an organization owns the PC or evidence needs preserving. Open Windows Security → Virus & threat protection → Scan options.
- Choose Full scan → Scan now and wait for completion. Record threat name, target, time and action status. Do not casually reconnect the suspect PC just for definition updates; ask official support when updates cannot be obtained safely.
- Before an offline scan, save work and check Microsoft’s prerequisites: supported Windows hardware, Defender as the primary antivirus, administrator rights and enabled Windows RE. Windows 11 ARM is not supported by Defender Offline. If BitLocker protects the system drive, Microsoft instructs suspending protection before the scan; otherwise recovery may request the key. Secure the key and understand the official suspension/resumption instructions first. Ask support rather than changing managed or unfamiliar protection settings. Only when prepared, run Microsoft Defender Offline and review Protection history after the restart.
- For action needed, follow recommended quarantine/removal. Do not choose Allow on device or restore an item whose safety is unknown. Preserve useful details promptly because Protection history is not a permanent archive.
- If another antivirus manages protection and these options differ, use its official scan procedure. For managed settings or inaccessible protection, ask the administrator/vendor rather than disabling security.
What the result means and what to do next
| Situation | What it tells you | Next action |
|---|---|---|
| Action needed or remediation incomplete | Threat handling is not complete. | Maintain isolation and follow the recommended action or vendor support. |
| Quarantined or removed | That detected item was handled; earlier exposure or other access is not ruled out. | Verify account protection. If remote access occurred, discuss recovery in Step 7. |
| No detections or no history entry | Nothing was detected or retained there; misuse of legitimate remote tools needs separate review. | For known remote access, suspicious logins or damage, use Steps 2, 4 and 7. |
- Expected result or what you learned
- The scan completed and you can identify the detected item’s action status.
- If something is wrong or unclear
- Repeated detection, incomplete remediation or unexplained disabled protection needs recovery support. If offline scanning never starts, check official prerequisites with support; do not improvise registry changes.
- How to undo changes
- Do not restore suspicious quarantined/deleted files as a test. Keep antivirus and firewall protections enabled; follow the official plan to resume any BitLocker suspension.
Step 7: Choose recovery and support after remote access or actual harm
- Contact your organization’s administrator, or for a personal PC the manufacturer and an official security advice service. IPA’s advice service is for Japan. Unknown remote-access scope is not cleared by uninstalling a tool or obtaining a clean scan.
- For support-scam remote access, IPA recommends System Restore, or reset if restoration cannot be performed. Agree on the official procedure with support because recovery affects apps, data and evidence. Preserve an organization’s device until its investigation is complete.
- If reinstalling is appropriate, preserve needed documents/photos and the BitLocker recovery key. Do not restore unknown apps or possibly infected executables in bulk. Prepare recovery media from official sources using a trusted device.
- For encrypted files or a ransom demand, disconnect external storage too and protect usable backups. Do not rush into payment, deleting encrypted files or running an unverified decryptor. Contact official specialist/police support.
- For fraud or unauthorized transfers, contact the payment provider and police. Provide contact details, payment records, screenshots, times, installed software and actions tried. Never send passwords or verification codes to a support contact.
- Expected result or what you learned
- Device recovery, account recovery and financial harm are being handled as separate needs.
- If something is wrong or unclear
- Resetting the PC cannot retrieve stolen data or reverse an unauthorized payment. Continue account and incident support.
- How to undo changes
- Reset/reinstall is not easily undone. Confirm needed files, keys and investigation records before proceeding.
When to ask for help
Organize a support record into time, unauthorized actions, whether you approved remote access, installed software, successful/failed sign-ins, detection/action status and payment/file damage. This guide cannot establish infection status or the scope of data exposure. Keep names, email addresses, computer names and credentials out of public screenshots/logs.
FAQ
Does a moving mouse prove someone has taken over my PC?
No; input-device faults can cause movement too. Unsolicited typing, app actions or messages, or remote access granted to a suspicious person, warrant isolation first.
Can I check without buying software?
Windows Security scans, Protection history and your services’ sign-in records provide useful checks. No detection does not rule out legitimate remote-tool misuse or account compromise.
Does seeing a virus warning mean I was hacked?
Fake warnings can appear without infection. Distinguish viewing a page from running software, granting access or entering credentials, then respond to what actually happened.
Does a suspicious Microsoft sign-in prove PC malware?
Account and device compromise differ. Password reuse or phishing can also expose accounts. Review successful activity and secure the account from a separate trusted device.
Does disconnecting make everything safe?
It interrupts communication but does not remove local software or retrieve already exposed data. Continue account protection and device investigation/recovery.
Must every suspected compromise lead to a reset?
Slowness or a warning alone does not justify a universal reset. Unknown impact after suspicious remote access needs official recovery advice, with data and evidence preserved first.
Sources
English adaptation of the Japanese guide, preserving containment, account protection, evidence and recovery branches. This is an initial-response guide, not a forensic investigation or proof of device safety. IPA and police contacts describe support in Japan; elsewhere use your local official incident-response and police channels.
IPA: ransomware response and advice (Japanese)Japan National Police Agency: support scams (Japanese)IPA: misuse of legitimate remote-access software (Japanese)IPA: fake warnings and recovery after remote access (Japanese)Microsoft: scan optionsMicrosoft Learn: Defender Offline requirements and BitLockerMicrosoft: Protection historyMicrosoft: recent account activityMicrosoft: sign out everywhereMicrosoft: account recoveryMicrosoft: recovery options