My sister navigated to a webstie and received a message she'd been infected and needed to call 'Microsoft' for help. Which, she did. The person that answered had her run iexplore + some website from a command prompt, installing an unknown remote control app and the person took control of her computer. He showed her something indicating she had been '91% infected' and that her IP address would be compromised for 'all her devices', unless they helped her. At this point she finally called me and hearing red flags I told her to power off her laptop and hang up.
Upon getting access to the laptop I used a hirens boot cd to run mini xp and ran malwarebytes and some antivirus, which found and removed a few items. After, from safe mode, I ran rkill, malwarebytes, adwclean, roguekiller, and trendmicro's stand alone antivirus, again a few discoveries were removed. I then finally did a regular boot and repeated rkill, malwarebytes, adwclean, finding nothing. I also noticed goto meeting and a citrix launcher showed as being installed around the time of the indicent, but I cannot confirm they are related. I uninstalled those and reset IE and firefox to defaults.
Where can I find some more information about this type of attack?
And what else should I look for to make sure her computer has been cleaned?
She's running Win8.1.