The symptoms suggest that the computer may be compromised, potentially with malware or unauthorized remote access. The first step in incident response is containment to prevent further spread or damage. Disconnecting the device from the network isolates it, preventing the attacker from continuing operations or accessing additional systems. Leaving the PC turned on preserves volatile data (e.g., memory contents, active connections) that may be critical for forensic analysis.