Dell fake support call

[Cambridge PC Support]

Customer had a call supposedly from Dell early the other morning. The usual stuff about being heavily infected. Then he flipped the screen and told him that it would cost £xx to resolve, the customer refused.

When I got to the computer it was set to boot into Safe Mode only, so sorted that and his documents are all missing, no Documents folder at all, no Music, Pictures, nothing! I've had a good look round and found absolutely nothing. Even looked for deleted files, still nothing. No hidden partitions, no large archived files

The only other trace I can find is some LogMeIn Rescue files in appdata.

Weird one that

[PBComputer]

have you tried running unhide.exe? from bleepingcomputer?

[Cambridge PC Support]

Nope, did an image then restore to another drive (minus security settings) and also viewed filesystem from a Unix boot Cd. Also checked for hidden partitions.

[Cadishead Computers]

is anything hidden in a different profile or similar?

Just find it extremely weird how anyone could do this..

[Cambridge PC Support]

Yep it is very weird.

I checked all over, searched for .doc file and .jpg files. Also ran an undelete tool against the partition, nothing, the only folder in his profile was AppData.

The profile was acting up so I've now created a new one and given it all back to him.