Want to highlight a helpful answer? Upvote!

Did someone help you, or did an answer or User Tip resolve your issue? Upvote by selecting the upvote arrow. Your feedback helps others! Learn more about when to upvote >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Safari Locked - Scam by "Apple Support Buddy"

My parents unfortunately were scammed recently - Safari locked on their computer with a popup saying they needed to contact Apple Support Buddy immediately to remove the virus. They were told that their "warranty had expired" and that they would need to pay $200 for them to remove the virus. They then allowed remote access to their computer for the scammer to install software - things like Ad block, etc. While in remote access, they also sent them an email and asked them to log into Apple. Very soon after the call ended, they realized afterwards this was a scam.

My question is twofold. I immediately called Apple after this, and was told I would need to backup all my files with support at the Apple store, and would then need to erase my hard drive. At the store however, Apple removed the software installed, did a scan, and said that everything was removed and that I do not need to erase my hard drive. On the support communities and elsewhere online, there is contradictory information about erasing the hard drive. So my first question is do I need to erase my hard drive? My second question is that even if I do erase the hard drive and back up my files on an external drive, can I use those files on the external hard drive on the newly erased computer? I have been told that those files could have remnants of the programs installed, however, if Apple says they removed everything, I would assume I could still use these. Any help is appreciated, am quite confused about what to do. Thank you.

iMac (21.5-inch Mid 2011)

Posted on Aug 27, 2015 5:22 AM

Reply
Question marked as Best reply

Posted on Aug 27, 2015 6:17 AM

You should erase and reformat your hard drive, then restore your computer from a backup made prior to when they allowed them access. Change their passwords and other critical information also. You don't know what software might have been installed.

8 replies

Aug 27, 2015 7:57 AM in response to bluewisteriaNYC

You are welcome. While it would be better to erase and reinstall, if there is no backup, and there is important data on the computer, then you may be stuck with Apple's scan. One thing that might work is to copy their home/user folder(s) to an external drive, which should preserve their data. Then erase and reformat. Then copy the folder's data back. I would also have them start backing up.


If they supplied credit card information, that card should be frozen or replaced.

Aug 30, 2015 1:21 PM in response to Eric Root

On August 26 I received a pop-up ad when I tried to open Safari. It claimed that "Windows" had detected a virus in my computer and that all my information was at risk, including my banking information. It warned me not to turn off the computer or do anything else until I called 855-866-8775. I called and got a man named "David," who asked for my computer's serial number. I gave it to him and immediately he had access to my computer. He said my computer had been infected with a virus called "Koobface" that originated in Russia, and that my WiFI was not safe and my network not secure. He said he would connect me to a tech who would clean my computer for $149. The tech's name was "Steve". He asked for my credit card number and said the charge would be $219 to get rid of the virus. He also said he was with "Support Buddy", a "direct competitor of Apple", and that Apple would charge me more than $600 for the same service.


(Actually, when I took my computer to the Apple Store, they deleted all the files that "support buddy" had installed and made sure there were no harmful things in the computer. THEY DID NOT CHARGE ME ANYTHING, and said they were aware of the Support Buddy scam, and that if I had any more trouble, I should return to the Apple Store and they would fix it again for free!)


Now, back to "Steve" and "Support Buddy". Once he had my credit card number, he asked me to click on their OK button to give them permission to charge my card. I did. Then "Steve" transferred me to a young lady who had control of my computer and who went through all the files checking to detect the virus. She ultimately blamed the "virus" on the fact that I had downloaded a program called MacKeeper and said never to do that again. "support Buddy" had control of my computer for a total of at least 2 hours. When the young lady finished, she said I should be sure to call them again before September 16, so that they could clean my computer again. After that, there would be a monthly charge for the service.


I soon suspected I had been scammed. I called my credit card company to cancel my current card and get a new one. I also called my brokerage firm to changet my IDs and passwords to my accounts and institute other safeguards. I would also strongly suggest that any one else who has been contacted by "Support Buddy" do as I did and in addition file a complaint with the Federal Trade Commisssion as I did. It's easy to reach the FTC complaint website online through Google it's the only way to stop scams like this one.

Aug 30, 2015 1:30 PM in response to Kathleen 166

Thank you for your message and sorry to hear you were scammed by the same group.

One question - did you erase your hard drive? I have been advised by several people at Apple that the scan that was done and removal of programs installed by Support Buddy is enough - that my computer is safe and there is no need to erase my hard drive.

Thanks.

Aug 30, 2015 1:52 PM in response to bluewisteriaNYC

I did not erase my hard drive. I took my computer to the Apple Store and they did a scan and deleted all suspicious and harmful files without erasing the hard drive. I am confident that my computer is now scam-free and virus-free. Going directly to the Apple Store was the quickest and safest way to solve my problem. I recommend that you do the same. In addition, report your experience with "Support Buddy" to the Better Budiness Bureau and the FTC and other law enforcement agencies you can find online.

Safari Locked - Scam by "Apple Support Buddy"

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.