Here’s a link to the real Microsoft Windows Security Center:
http://www.microsoft.com/security/default.aspx
You should opt in to receive automatic updates from Microsoft, if you haven’t already done so.
There’s a link on the above page regarding phone scams and what not to do and what to do if you get one.
http://www.microsoft.com/security/online-privacy/avoid-phone-scams.aspx
Too late. Leaving the computer on the internet means its new owners will just download more and more malware to it. It is probably impossible to fix with any native tools at this point. The only way to fix it is to yank out the network connection, then work on turning off the malware. That can generally be done running autoruns and turning off most items. Nothing will work well after that but that includes the malware. Then he can salvage files and buy a new computer or reflash firmware and reinstall the OS on this one.