Corrupt base system in Apple disk image

If a remote party has root access, your system is completely corrupt. Wipe it, and start over. Change all your local passwords, your firewall passwords, your financial passwords, your mail server passwords, and notify your financial providers. Roll in your backups from prior to whenever this first started.

Erase everything, and reload from known-good distributions. All Macs, any network-connected printers, routers, network-attached storage, everything. If there were yutzes loose on one Mac and with root access, then that Mac was probably also used to access other devices. Which means access credentials were likely exposed. Sure, theorecticalky, isolated systems are secure. But we all use passwords ro acces those other systems.

Loading sketchy software, cracked apps, torrented apps, and apps from sites other than the original developer site or the Mac App Store can allow access, and can allow adware and such. Weak passwords and common passwords can be trouble, too. Weak passwords because they get guessed, common passwords because one password known means multiple logons gained.