Anybody hear of Geek Technical Support? They seemed to know what they were doing, but their business practices were suspicious.

MaryCarolG wrote:

What do I do?

Definitely follow Csound1's suggestions. You should be able to get your money back.

Erasing your Mac and reinstalling is a good idea, but not everyone can do that at the drop of a hat. I suggest you contact the real Apple support at http://www.apple.com/support/ (1-800-275-2273), tell them what happened, and schedule a Genius Bar appointment to have them check your Mac. If you don't already have a backup, you will probably have to purchase a backup drive. At least it will cost much less than $600 and is something you need anyway. If you are too far from an Apple Store, you could go to any Authorized Apple Service centre, like Best Buy, for example. Apple would be best, of course, but sometimes you have to take what you can get. And when in doubt, you can always ask us. Just tell us which "big box" computer stores are nearby and we can tell you the best one to go to.

I fully agree with the advice you've already received. You need to erase your hard drive to ensure that these scammers don't still have some kind of remote access, or haven't installed some kind of keylogger or other spyware. Anti-virus software will not help, as a savvy scammer can do such things using tools and techniques designed to avoid detection by anti-virus software.

For detailed instructions on how to do this, see:

How to reinstall Mac OS X from scratch

As to the things they told you... tech support scammers are able to trick people by having them run "tests" whose results are completely normal, but which the scammers can point to and say, "Look, here's evidence of a hack." In reality, there never was any hack or virus, until you gave access to your computer to these scammers.

In the future, if you are looking for help with your Apple devices, go straight to Apple's Support page:

http://www.apple.com/support

Do not use Google to search for Apple Support... you'll get a bunch of scam ads that Google doesn't do a good job of screening.

Why do you ask? Did you get hit by the tech support scam? If you question someone's business practices, then don't do business with them.

If this is regarding a tech support scam, please describe everything that happened. You may need to start changing passwords, calling your bank, and calling the police.

You have been scammed, and now that you have allowed the criminals access to your Mac you must consider it compromised, and all personal info (bank accounts, other online accounts etc) similarly compromised.

Contact your credit card companies (especially the one you used to pay them with) and stop them all, file a dispute in order to recover your money) Change all passwords that could have been accessed by the criminals and watch your financial accounts very carefully

Then erase your Mac and reinstall from scratch everything except data files.

Exactly what I just posted (the post you replied to) start with the financial items, that is where the most risk is. Turn the Mac off and leave it that way, you do not know whether 'Geeks' are still inside it

The standard recommendation is to erase your hard drive and reinstall the operating system directly from Apple. Then restore only your user files. Technically, that is the correct approach, but it can be intense if you aren't comfortable with that sort of thing.

If you don't want to do that, the next best option is to have someone look at the machine in person to verify there is nothing out of place. In particular, they should check System Preferences > Sharing and make sure everything is turned off.

If you can't do that either, there is still one more step that would make me feel a little better. I wrote a little diagnostic program to help show what programs are running hidden in the background. Download EtreCheck from http://www.etresoft.com/etrecheck, run it, and paste the results here. EtreCheck is perfectly safe to run, does not ask for your password to install, and is signed with my Apple Developer ID.

Running EtreCheck is not going to guarantee a 100% clean machine. It is not as good as erasing your hard drive and reinstalling. it is not as good as having a competent technician look at your machine in person. But if there is some obvious back door still installed, it might show it.

Disclaimer: Although EtreCheck is free, there are other links on my site that could give me some form of compensation, financial or otherwise.

I wouldn't be so sure that all the scammers wanted was money. You should read the following article on the topic, posted yesterday, especially the reports of how some scammers respond when they don't get what they want:

http://www.welivesecurity.com/2015/04/14/tech-support-scammers-teeth/

It's likely that there's nothing wrong and your machine is clean, but not even the Apple tech's confidence in that is a guarantee. Only a true security expert could give you such a guarantee, and only after a lot of work. I wouldn't even attempt it, as there's always room for error, and it's much less effort to just erase everything.

Of course, it is your choice, and you must do what you're comfortable with. If you are comfortable taking a small risk that something malicious may have been done in order to avoid the hassle of reinstalling everything, then you can leave the system as it is. If even a small risk of that makes you uncomfortable, though, you should erase the hard drive for peace of mind.

MaryCarolG wrote:

We have a Time Machine. If we wipe the computer, can we reinstall from the Time Machine?

Yes, absolutely. Erase the hard drive and restore to a point in time before the scammer had access. That will be the most painless way to deal with that.

However, for safety's sake, it would be best to have another secondary backup before erasing your hard drive. I've heard too many sad stories of people who thought they were backed up, erased the hard drive, and then found that their Time Machine backup drive had failed without them realizing it. Having two separate backups protects you against that.

I did read through what has been mentioned, but don't think I saw this one. Have that credit card number cancelled immediately and have a new card issued. Either the scammers will try to use it for illegal purchases, or they'll sell the number to any number of other crooks who will.

MaryCarolG wrote:

My husband says he will run your program as soon as he finishes the taxes.

Just post the results here and pretty much anyone can tell if anything looks wrong.

You are correct about the current scams. Plus, there are very few true viruses to implant. The biggest risk are perfectly legitimate programs that can be used to create backdoors. EtreCheck will only report some of these because some of them are built into the operating system. You would have to go to System Preferences > Sharing and make sure everything is turned off. Hopefully the Apple support technician did that.

I don't disagree with what anyone says about erasing the hard drive and reinstalling. Thomas really nails it. It is possible to thoroughly check things out in person, but in the real world it is so much easier to just wipe and restore. But even that may be a challenge for some people and there may not be any nearby support options. Each situation is different and I don't want anyone to risk losing irreplaceable data out of fear that someone else may have accessed it.

Another reason I would like to see the EtreCheck report is because it includes some information about the status of your backups. Before taking a machine in for any kind of service, you should have a good backup. As Thomas pointed out, if you know you are going to need such a backup, the ideal action is to make a secondary backup in addition to Time Machine. And don't forget than any changes you make during this period, like taxes, should be saved somewhere else too. If you wind up restoring your machine to a state from 3 days ago, your tax information could be lost. If you are using some software, make sure to look for an archive feature and save everything somewhere else.