IT admins no longer have to work onsite to monitor the status of hardware: logging on via a remote connection enables an entire company’s assets to be monitored and managed fast, efficiently, and securely. Resetting the PC (ideally with fresh install media) is the best solution there.Support staff can attend to customer problems quickly and effectively with a TeamViewer remote connection, immediately assessing the problem and passing the ticket straight on to the right person. Since in your case you didn't have TeamViewer installed, you should probably be quite concerned about possible malware because if the attacker had the necessary privileges to install Teamviewer, they may have done more than just Paypal. You can configure Windows to stay connected to the network while on sleep, and in this case sleep doesn't protect against remote control attacks. Some programs can wake up the computer and exit sleep, but your computer should disconnect from the network so you avoid the Teamviewer-style attack. On sleep, you should be safe but it depends on your settings. If you want to be certain nobody can use your machine while you're not sitting in front of it, your best bet is to disconnect the computer from the network, hibernate or shut down. Teamviewer may still transfer files as Martin Fürholz mentioned. If you lock your PC, most forms of remote control become more inconvenient for the attacker but you're certainly not completely safe. Other software, notably Remote Desktop, interacts with your user session directly which is why you can log in with Remote Desktop even when the computer appears locked to a physical person sitting there.

This is why anything seen through Teamviewer is the same as what the physical person in front of the computer would see. Teamviewer interacts with Windows as if an extra keyboard/mouse/monitor were plugged in.

Any processes you have open in your user continue running and this is why you can download a file and lock your computer, and it will continue downloading while your computer is locked. Locking a Windows computer with Windows+L simply prevents the physical user from interacting with any of the processes running within your user.

Teamviewer online remote session