LOL I just thraalllled this guy. I have a VERY well lived in "looking" VM, and I have even managed to edit the bios .rom in msinfo32 so it doesn't say VMware all over the place. (A simple youtube search can show anyone if interested). He's telling me CCleaner, Malwarebytes, Avast, all that stuff on my computer is useless and this is a hacking issue not a virus issue. I ask him why he's trying hard to syskey my computer over & over & put password 1234 etc... I of course replaced syskey.exe with another random executable that doesn't run.
My favorite part is that when he had me run "iexplore www.helpme.net" his name came up as nancy jones all in lowercase. It goes to a GoToAssist page. Welp, hopefully GoToAssist is one of the services that reveals their IP... I'm going through the Wireshark log now... keep up the good fight, gang!