After helping my friend fix her computer (thank you nasdaq), she left it on all night for two nights and got a Windows Defender pop-up. Instead of calling me, she contacted the 1-888 number and allowed remote access to who she thought was a Microsoft rep. Thank god she didn't close out any windows after her session with this guy. He looked through EVERYTHING! Memory Info., Scheduled Tasks, Disk Drive, Operating System, Recent Events, CPU, Process, cmd.exe (commands) etc...then wanted to charge her money to fix the said problems. Showed her what looks to be a bogus Event Log and wanted her to contact Sisco, he was going to connect her via online but she declined for a second opinion (me/us). I have phone screen shots of the all he did/looked at, if you need them.
Let me know if you need a Farbar done, not doing anything without the go ahead.
P.S. I had her turn off her router
Awaiting your response