She described the installer and the suspicious folders. He asked a few precise questions—had she clicked any unknown links, which browsers were open—then suggested immediate steps. “Disconnect from the network,” he said. “Archive the download folder. Check your browser extensions and remove anything new. Back up your docs to an external drive offline. Then let me take a look.”