Speed matters more than certainty. If you think a password may have been exposed, act as if it was — the cost of being wrong is a few minutes.

Do these four things, in this order

1. Change passwords from a device you trust — your phone or another computer. Never from the machine you suspect: if something is watching, it will simply capture the new password too.
2. Turn on two-factor authentication everywhere it is offered, starting with email and banking. A stolen password then stops being enough.
3. Check the account itself — recent sign-in activity, recovery email and phone, and any mail-forwarding rules. Attackers leave a way back in; removing the intruder from the computer does not remove it from the account.
4. Watch the bank. In the case from Lesson 1 the money moved roughly a week after the incident, long after everyone assumed it was over.

You have finished the course. If one habit comes out of it, make it this: passwords live in the vault, never in the browser — and a new computer does not make an old problem disappear.