I was AFK from my Windows 10 machine, without locking it, and came back to an active TeamViewer session and someone remotely performing a PayPal donation. I do not have TeamViewer installed.
I'll reinstall my machine and make some security changes, however I'm wondering: would the same thing have been possible if my session was locked? Does locking one' session protect against any form of remote control?
Locking the machine only blocks being able to physically interact with it. It is still running in the background, including all the networking.
So, yes, the machine is still running, even when you lock it, which means that all functions, including "backdoors" still function.
This is true even for legitimate use of Teamviewer. It is normal to keep the machine running, lock it, go home, then use TeamViewer to access your machine from home. It's how "work from home" was done for a long time for many people. The computer is still running and all the functions still work.
Sleep/suspending, on the other hand, is different.
TeamViewer works like physical access to the machine. The remote user would still have to log in to the Windows session, if you locked the machine. I think it can still transfer files, if I'm not mistaken. So you wouldn't be 'safe' at all. But it would be a little less convenient for the bad guy.
So locking your machine wouldn't block the attacker from connecting remotely, but it would stop him from using your active user session the way you described it.
Locking a Windows computer with Windows+L simply prevents the physical user from interacting with any of the processes running within your user. Any processes you have open in your user continue running and this is why you can download a file and lock your computer, and it will continue downloading while your computer is locked.
Teamviewer interacts with Windows as if an extra keyboard/mouse/monitor were plugged in. This is why anything seen through Teamviewer is the same as what the physical person in front of the computer would see. Other software, notably Remote Desktop, interacts with your user session directly which is why you can log in with Remote Desktop even when the computer appears locked to a physical person sitting there.
If you lock your PC, most forms of remote control become more inconvenient for the attacker but you're certainly not completely safe. Teamviewer may still transfer files as Martin Fürholz mentioned. If you want to be certain nobody can use your machine while you're not sitting in front of it, your best bet is to disconnect the computer from the network, hibernate or shut down. On sleep, you should be safe but it depends on your settings. Some programs can wake up the computer and exit sleep, but your computer should disconnect from the network so you avoid the Teamviewer-style attack. You can configure Windows to stay connected to the network while on sleep, and in this case sleep doesn't protect against remote control attacks.
Since in your case you didn't have TeamViewer installed, you should probably be quite concerned about possible malware because if the attacker had the necessary privileges to install Teamviewer, they may have done more than just Paypal. Resetting the PC (ideally with fresh install media) is the best solution there.
As always, the correct answer is "it depends".
A program not requiring user interface interaction will always work - and allow remote interaction - no matter if the screen is locked or not. Network communication is not interrupted because you lock the screen.
But tools that directly interface with the UI are impacted by screen lock, and again, "it depends":
If teamviewer is installed on the host level (only possible with admin permissions), remote control works even after locking the screen. Since the remote user would only see the windows login screen he/she would need to enter your credentials to unlock the session before being able to do anything of value.
When teamviewer is run in the user session (e.g. quick support) it will only work until you lock the screen. Then the user interface is disabled and remote interaction is not possible anymore.
For both cases you can see that screen lock is a good security measure, that's why most companies automate it e.g. after 15 minutes.
Assuming your user session did not have admin rights: locking your screen would definitvely have prevented the teamviewer-browser-paypal scenario. It would not have prevented other kinds of issues like data exfiltration, etc.
