Scam Library
How to tell if someone is controlling your PC
Signs of an unexpected remote session, without turning the check into folklore.
The reliable sign is a remote-support session you did not start: a cursor moving, a window from a remote tool, or a caller coaching you through one. Unexpected new software with a name like a support or desktop tool is the other common sign.
A slow computer, by itself, is not evidence. Antivirus pop-ups that demand a phone call are a common lure, not a diagnosis.
Disconnect, close the session, and run a check aimed at remote-access software rather than another generic virus slogan. If a session was real, change important passwords from a different device.