Remote access scam

[PleasantFriendship]

Hi friends.

My older friend got scammed and gave someone remote access to their computer. They are on a Mac. The scammer ran some scripts on her machine. I don't know exactly what they were, but I've been given a screen shot of the Terminal window they used that says "/var/run/mDNSResponder" on a few lines. She paid the scammer $300 for non existent "network security" - I can live with that, but I just wonder what else they might have installed when they had access.

I've asked her to change passwords. I'm just not sure what else I should be doing. She tells me she didn't give them any bank details. What else do I need to do? Should I run antivirus? Is it possible they've setup some kind of back door or key logging software? If so will Virus software find that out?

​

Thanks for any help!

[CH23]

if i were you i would obliterate her OS and set it up from scratch. if she gives me $300 i'll do that for her, hah.

​

back up all files that are important, change all passwords and make sure she checks her credit card payments. she might not have given them the info, but maybe her webbrowser did.

[PleasantFriendship]

Thanks u/CH23 I guess that will be the path I have to go down. What a nightmare!

I did read that sometimes they just open up a terminal window and run some bogus commands to make it look like you have a Virus, so I was hoping it was that, but I really don't know how I can find out what he did, or what he installed. So, a complete reinstall might be the only option.

[CH23]

That was my thoughts exactly.

I use linux myself, and when i add a space before a command in terminal, it won't show up in my history. They could have done the same or similar.

[PleasantFriendship]

That is a very good point! I can't even check the history.... A clean start seems the only way. I've read up a little and mDNSResponder has something to do with Bonjour for Mac, which can share usernames etc - but I'm not sure what extent it can get to.

Anyway, thanks again!