Urgent Tech Help a.k.a. UTH
Queja 336320 Detalles

set up a VM and contacted this company. said someone named john left a message about something to do with microsoft and a virus. they then instructed me to open a command prompt. they had me run the command assoc which shows file associations and some CLSID's they had me find a particular CLSID that is EXACTLY THE SAME ON ALL WINDOWS COMPUTERS. it is the zfsendtotarget CLSID key. i then remoted the person into my system who then added ccleaner and opened a command prompt. he ran 2 scripts. one to remove teamviewer from the system task tray as well as remove it from add/remove programs. the second one erased all footprint of them from my system. however the script did forget one log which showed all their activity. they copied all software keys and registry keys over, they also imported all saved passwords from IE and chrome. luckily it was all dummy info.
i also set up a password protected folder with phone bank info and credit card info inside. they advised me that that folder was the cause and they needed to access it to check it. i said it had bank info and was not sure i wanted them to access. they said my computer would become unusable if we didnt fix. at that point i stopped him. explained that i knew it was a scam and that the gig was up. i let him know it was fun messing with him and glad to waste some of his time scamming other. he hung up on me after calling me a A**hole :)