This is a SCAM. They start by saying they are from Windows tech support. Then they have you look up the error messages on your computer. There will be a lot and per my nephew who is an IT guy, that is fairly normal. Then they ask you to open a file called Teamviewer. This is a remote software product that gives them access to your computer. DO NOT DO THIS. Microsoft/Windows would not utilize Teamviewer they would use their own remote access software.
I was stupid enough to go along for the ride, spending 75 minutes with this supposed Windows Tech Support that will tell you they are not affiliated with Microsoft. The call reps have thick Indian? accents, admitting they are calling from Southeast Asia. They inform you that your computer has sent numerous alerts and warnings to them, implying Microsoft in Washington, so they are calling to help diagnose. First, the rep has you run eventvwr to show you a long historical log of errors, warnings, and alerts, pointing out the total number is in the thousands. However, these messages are likely nothing to worry about. I foolishly installed TeamViewer remote access software from the official product website (http://www.teamviewer.com) , so hopefully, that didn't cause too much damage. After you are connected, the rep runs msinfo32 and runs the command prompt (run cmd) then uses commands like ipconfig, tasklist, and netstats to scare you into thinking you have too many malicious processes running on my computer when they are all likely normal server connections, IP address names, and windows processes. He claims that svchost.exe and lsass.exe are malicious. He tells you your IPv6 address is the wrong format when you run ipconfig. He purposely shows you this web page and tells you to read the scary bullet points 1) and 2) to make you think you have malicious processes:
http://www.liutilities.com/windows-process/svchost-exe/
After you are thoroughly scared, he tries to convince you to buy tech services for $199 from this website supposedly in Washington state and tells you to notice the Better Business Bureau's A- rating for the company:
http://ebiztechservices.com/priceplan.aspx
At the beginning of the call, I said I didn't want to buy tech services or didn't need tech support, and he claimed he wasn't selling anything, but by the end of the call, they push you to click on the Buy Now button for either $199 for 1 PC or $299 for 2PCs. The tech rep, although connected remotely to you, cannot click the button for you and urges you to push it. Fortunately, I stopped at that point.
I am hoping that the TeamViewer remote connection was merely meant as a scary demo and they didn't download or upload anything malicious to my computer.
The company will give this return phone number with a supposed Microsoft certified technician name and ID badge number, but says they don't have a website or an official company name. They are simply insistent that they are technical support for Windows, which I guess is generic and truthful enough. Given the heavy accents, I doubt they are using their real names, which are English or British names. Well, I guess Britain did occupy India.
Another point that my friend who upgraded my computer made: How would the scam artist know your phone number and/or name given I didn't register with Microsoft?
svchost.exe and lsass.exe are usually normal processes that run. There are viruses that could corrupt those files, but their mere presence doesn't indicate viruses:
http://windows.microsoft.com/en-us/windows/what-is-svchost-exe#1TC=windows-7
http://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
http://en.wikipedia.org/wiki/Svchost.exe
IPv6 is just a newer IP addressing system that allows the creation of more unique IP addresses:
http://en.wikipedia.org/wiki/IPv6
TeamViewer software is legit, and although not popular, it receives good ratings:
http://download.cnet.com/TeamViewer/3000-7240_4-10398150.html
I received a call from a person who said I needed to delete hacker files immediately. He had an Asian accent, I asked his what his name was twice and he finally said, "John Williams." I said, Wow a good American name! He said, Yes. I asked what company he was calling from. He claimed to be a Senior Microsoft Technician. I said, "Oh so you work for Microsoft?" He said, No that I have purchased a service from him and his is my personal technician. I said, "Oh really, how is it I have purchased your services?" I asked for his number he gave me 850-659-6668 and I asked three times for his extension Number which he gave me Ext 8014. He asked me to go and turn on my computer. I told him "my computer is off." He said with authority. I can't fix your computer unless you turn it on. I said, "No my computer will stay off." I said, Since my computer is off, "How is it that you know I have been hacked?" He said," through networking and other devices. It is very important that I turn on my computer now." I told him I would "call him back!" Then I hung up!
Just to add to the thread, we got a call yesterday of the same nature. Luckily we had the sense to ask for name, call back number, and location, because it became very apparent that something was fishy. The man who called had a thick accent, claiming he was John Williams from "Flow-rita" (Florida) and he was very insistent that we turn on our computers and start taking instructions. As mentioned above, we were told that we received notifications through microsoft, and that our IP address was sending the distress call, but when we confronted him about which OS version we were using, he couldn't supply an answer. We use multiple version of windows at home, and normally part of the error report is the OS (be it xp, vista, 7, or 8) At this point we simply hung up and forgot about the issue. I hope that an added voice will help someone before they are scammed. Absolutely despicable