Might have been hacked. Guy got into Terminal

Question

Hi.  My 81 yr old dad called what he thought was Netflix...it wasn&#x27;t.  My gut tells me it&#x27;s a fraudulent site.  CreticWorld.comThe deal was this:  the "helper" found some very bad stuff on dad&#x27;s site, and offered to get it fixed for $400.  I imagine they were about to ask about his credit card to pay for it. The "helper" had my dad connect via a LOGMEIN type thing.He has my dad&#x27;s email.I don&#x27;t THINK he has my dad&#x27;s apple id or master password to the computer.I have run Malwarebites Anti Malware app...it didn&#x27;t find anything.There are no "updates" to be had in the app store.System 10.10.5  MacbookProI&#x27;ll paste the report from Terminal below.  At the end it has some scary phrases like     • Email compromised     • Worm found     • network compromisedBut...there is some funky spelling.1.  Advice?  I&#x27;m freaking out that my dad&#x27;s computer is hacked, and they&#x27;ll get his passwords, credit cards, bank accounts, etc.2.  What would YOU do?3.  Grateful for any advice.Pasted below is the terminal session.  I have no idea if it is real, if it is Pasted into Dad&#x27;s terminal to freak him out?  Can you tell if the Terminal Session is real?  What does it mean?  No idea if it is valid and hope a Terminal pro would give it a look.Brad In DenverLast login: Fri Jul  1 14:18:24 on consoleRobert-********-MacBook:~ robert********$ security scasecurity: unknown command "sca"Robert-********-MacBook:~ robert********$ email:********gmail.com-bash: email:***********gmail.com: command not foundRobert-*********-MacBook:~ robert***********$ netstatActive Internet connectionsProto Recv-Q Send-Q  Local Address          Foreign Address        (state)   tcp4       0      0  192.168.1.21.61271     mcs6-1-isp2.bgl..trivn ESTABLISHEDtcp4       0      0  192.168.1.21.61270     mcs7-1-isp2.bgl..trivn ESTABLISHEDtcp4       0      0  192.168.1.21.61269     mcs6-1-isp1.bgl..trivn ESTABLISHEDtcp4       0   1807  192.168.1.21.61268     mcs6-1-isp2.bgl..trivn ESTABLISHEDtcp4       0      0  192.168.1.21.61267     egw1.express.got.trivn ESTABLISHEDtcp4       0      0  192.168.1.21.61208     162.125.32.129.https   ESTABLISHEDtcp4       0      0  192.168.1.21.61175     den03s09-in-f14..https ESTABLISHEDtcp4      31      0  192.168.1.21.61157     server-216-137-4.https CLOSE_WAITtcp4       0      0  192.168.1.21.60970     4.53.54.157.https      ESTABLISHEDtcp4       0      0  192.168.1.21.60916     ec2-52-7-106-188.https CLOSE_WAITtcp4      31      0  192.168.1.21.60908     45.58.75.161.https     CLOSE_WAITtcp4      31      0  192.168.1.21.60850     d.v.dropbox.com.https  CLOSE_WAITtcp4       0      0  192.168.1.21.60791     ie-in-f108.1e100.imaps ESTABLISHEDtcp4       0      0  192.168.1.21.58983     216.52.233.177.http    ESTABLISHEDtcp4       0      0  192.168.1.21.56796     108.177.10.109.imaps   ESTABLISHEDtcp4       0      0  localhost.6263         localhost.55436        ESTABLISHEDtcp4       0      0  localhost.55436        localhost.6263         ESTABLISHEDtcp4       0      0  192.168.1.21.55412     17.249.204.18.5223     ESTABLISHEDtcp4       0      0  192.168.1.21.55410     17.172.238.201.5223    ESTABLISHEDtcp4       0      0  192.168.1.5.55397      74.125.126.108.imaps   ESTABLISHEDtcp6       0      0  2601:282:780:371.55048 2607:f8b0:4001:c.imaps ESTABLISHEDtcp6       0      0  2601:282:780:371.54741 io-in-x6d.1e100..imaps ESTABLISHEDtcp4       0      0  192.168.1.5.49579      ir-in-f108.1e100.imaps CLOSE_WAITtcp4      31      0  192.168.1.5.49549      client.v.dropbox.https CLOSE_WAITtcp4       0      0  localhost.49153        localhost.1023         ESTABLISHEDtcp4       0      0  localhost.1023         localhost.49153        ESTABLISHEDudp4       0      0  192.168.1.21.ntp       *.*                              udp6       0      0  *.58761                *.*                              udp4       0      0  *.58761                *.*                              udp46      0      0  *.*                    *.*                              udp4       0      0  all-systems.mcas.5350  *.*                              udp46      0      0  *.*                    *.*                              udp6       0      0  robert-montgomer.ntp   *.*                              udp46      0      0  *.*                    *.*                              udp46      0      0  *.*                    *.*                              udp4       0      0  *.acmsoda              *.*                              udp4       0      0  *.ssdp                 *.*                              udp4       0      0  *.fjicl-tep-a          *.*                              udp46      0      0  *.*                    *.*                              udp4       0      0  *.17500                *.*                              udp46      0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp46      0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.54457                *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4     228      0  *.vce                  *.*                              udp6       0      0  robert-montgomer.ntp   *.*                              udp6       0      0  fe80::1%lo0.ntp        *.*                              udp4       0      0  localhost.ntp          *.*                              udp6       0      0  localhost.ntp          *.*                              udp6       0      0  *.ntp                  *.*                              udp4       0      0  *.ntp                  *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp46      0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.kerberos             *.*                              udp6       0      0  *.kerberos             *.*                              udp6       0      0  *.mdns                 *.*                              udp4       0      0  *.mdns                 *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.*                    *.*                              udp4       0      0  *.netbios-ns           *.*                              udp4       0      0  *.netbios-dgm          *.*                              Active Multipath Internet connectionsProto/ID  Flags      Local Address          Foreign Address        (state)   icm6       0      0  *.*                    *.*                              Active LOCAL (UNIX) domain socketsAddress          Type   Recv-Q Send-Q            Inode             Conn             Refs          Nextref Addr8f2638df966c6e01 stream      0      0                0 8f2638df9ac951e9                0                0 /var/run/mDNSResponder8f2638df9ac951e9 stream      0      0                0 8f2638df966c6e01                0                08f2638df9ac943d9 stream      0      0                0                0                0                08f2638df9ac955d1 stream      0      0                0                0                0                0 /var/tmp/LogMeIn/Guards/.strmLogMeIn_AVMan8f2638df95393ed1 stream      0      0 8f2638dfa39000f9                0                0                0 /var/tmp/LogMeIn/Guards/.strmLogMeIn_AVMan8f2638df9ac95699 stream      0      0 8f2638dfa381fd39                0                0                0 /var/tmp/LogMeIn/Guards/.strmLogMeIn_AVMan8f2638df994f4f99 stream      0      0                0 8f2638df9ac94631                0                08f2638df9ac94631 stream      0      0                0 8f2638df994f4f99                0                08f2638df994f38f1 stream      0      0 8f2638df92b84799                0                0                0 /var/folders/d0/njyxhryn72s1x9f5zqvr4dj80000gn/T/ics36778f2638df994f4701 stream      0      0                0 8f2638df994f47c9                0                0 /var/run/mDNSResponder8f2638df994f47c9 stream      0      0                0 8f2638df994f4701                0                08f2638df994f4891 stream      0      0                0 8f2638df994f4959                0                0 /var/run/mDNSResponder8f2638df994f4959 stream      0      0                0 8f2638df994f4891                0                08f2638df994f4a21 stream      0      0                0 8f2638df994f4ae9                0                0 /var/run/mDNSResponder8f2638df994f4ae9 stream      0      0                0 8f2638df994f4a21                0                08f2638df994f4bb1 stream      0      0                0 8f2638df994f4c79                0                0 /var/run/mDNSResponder8f2638df994f4c79 stream      0      0                0 8f2638df994f4bb1                0                08f2638df95393e09 stream      0      0                0                0                0                08f2638df953929b9 stream      0      0                0 8f2638df95392a81                0                0 /var/run/mDNSResponder8f2638df95392a81 stream      0      0                0 8f2638df953929b9                0                08f2638df95392b49 stream      0      0                0 8f2638df95392c11                0                0 /var/run/mDNSResponder8f2638df95392c11 stream      0      0                0 8f2638df95392b49                0                08f2638df95392cd9 stream      0      0                0 8f2638df95392da1                0                0 /var/run/mDNSResponder8f2638df95392da1 stream      0      0                0 8f2638df95392cd9                0                08f2638df95392e69 stream      0      0                0 8f2638df95392f31                0                0 /var/run/mDNSResponder8f2638df95392f31 stream      0      0                0 8f2638df95392e69                0                08f2638df966c7059 stream      0      0 8f2638dfa1831889                0                0                0 /var/tmp/LogMeIn/Guards/.strmLogMeIn_AVMan8f2638df9ac95f31 stream      0      0                0 8f2638df9ac964a9                0                0 /var/run/mDNSResponder8f2638df9ac964a9 stream      0      0                0 8f2638df9ac95f31                0                08f2638df9ac94ec9 stream      0      0                0 8f2638df936d3631                0                0 /var/run/mDNSResponder8f2638df936d3631 stream      0      0                0 8f2638df9ac94ec9                0                08f2638df95394061 stream      0      0                0 8f2638df9ac95509                0                0 /var/run/mDNSResponder8f2638df9ac95509 stream      0      0                0 8f2638df95394061                0                08f2638df9ac94889 stream      0      0                0 8f2638df9ac95379                0                0 /var/run/mDNSResponder8f2638df9ac95379 stream      0      0                0 8f2638df9ac94889                0                08f2638df9ac946f9 stream      0      0                0 8f2638df9ac947c1                0                0 /var/run/mDNSResponder8f2638df9ac947c1 stream      0      0                0 8f2638df9ac946f9                0                08f2638df936d37c1 stream      0      0                0 8f2638df966c7699                0                0 /var/run/mDNSResponder8f2638df966c7699 stream      0      0                0 8f2638df936d37c1                0                08f2638df936d3569 stream      0      0                0 8f2638df9ac95da1                0                0 /var/run/mDNSResponder8f2638df9ac95da1 stream      0      0                0 8f2638df936d3569                0                08f2638df9ac96959 stream      0      0                0 8f2638df9ac96571                0                0 /var/run/mDNSResponder8f2638df9ac96571 stream      0      0                0 8f2638df9ac96959                0                08f2638df936d3ec9 stream      0      0 8f2638dfa5b94009                0                0                0 /var/tmp/LogMeIn/Guards/.strmLogMeIn_AVMan8f2638df936d3ba9 stream      0      0                0 8f2638df91078ae1                0                0 /var/tmp/LogMeIn/LogMeIn/com.logmein.logmeinserver.socket8f2638df91078ae1 stream      0      0                0 8f2638df936d3ba9                0                08f2638df936d6129 stream      0      0                0 8f2638df91078ba9                0                0 /var/tmp/LogMeIn/LogMeIn/com.logmein.ui.socket8f2638df91078ba9 stream      0      0                0 8f2638df936d6129                0                08f2638df936d6061 stream      0      0                0 8f2638df966c6ec9                0                0 /var/run/mDNSResponder8f2638df966c6ec9 stream      0      0                0 8f2638df936d6061                0                08f2638df966c6d39 stream      0      0 8f2638df93e7b3d9                0                0                0 /var/tmp/LogMeIn/LogMeIn/com.logmein.ui.socket8f2638df936d53e1 stream      0      0 8f2638df93e55889                0                0                0 /var/tmp/LogMeIn/LogMeIn/com.logmein.logmeinserver.socket8f2638df9ac96bb1 stream      0      0                0 8f2638df9ac958f1                0                0 /var/run/mDNSResponder8f2638df9ac958f1 stream      0      0                0 8f2638df9ac96bb1                0                08f2638df9ac95e69 stream      0      0                0 8f2638df9ac96189                0                0 /var/run/mDNSResponder8f2638df9ac96189 stream      0      0                0 8f2638df9ac95e69                0                08f2638df936d34a1 stream      0      0                0 8f2638df966c7829                0                0 /var/run/mDNSResponder8f2638df966c7829 stream      0      0                0 8f2638df936d34a1                0                08f2638df9ac971f1 stream      0      0                0 8f2638df936d3a19                0                0 /.dbfseventsd8f2638df9ac97129 stream      0      0 8f2638dfa0ca20f9                0                0                0 /.dbfseventsd8f2638df936d3a19 stream      0      0                0 8f2638df9ac971f1                0                08f2638df966c7379 stream      0      0                0 8f2638df9ac96ed1                0                08f2638df9ac96ed1 stream      0      0                0 8f2638df966c7379                0                08f2638df9ac96e09 stream      0      0                0 8f2638df966c80c1                0                08f2638df966c80c1 stream      0      0                0 8f2638df9ac96e09                0                08f2638df966c8189 stream      0      0                0 8f2638df936d4f31                0                08f2638df936d4f31 stream      0      0                0 8f2638df966c8189                0                08f2638df966c7121 stream      0      0                0 8f2638df966c9061                0                08f2638df966c9061 stream      0      0                0 8f2638df966c7121                0                08f2638df966c7f31 stream      0      0                0 8f2638df966c8c79                0                08f2638df966c8c79 stream      0      0                0 8f2638df966c7f31                0                08f2638df966c8ed1 stream      0      0                0 8f2638df936d5ae9                0                08f2638df936d5ae9 stream      0      0                0 8f2638df966c8ed1                0                08f2638df966c7da1 stream      0      0                0 8f2638df966c72b1                0                08f2638df966c72b1 stream      0      0                0 8f2638df966c7da1                0                08f2638df966c64a1 stream      0      0                0 8f2638df966c6569                0                0 /var/run/mDNSResponder8f2638df966c6569 stream      0      0                0 8f2638df966c64a1                0                08f2638df966c67c1 stream      0      0                0 8f2638df966c6889                0                08f2638df966c6889 stream      0      0                0 8f2638df966c67c1                0                08f2638df966c6951 stream      0      0                0 8f2638df966c6a19                0                08f2638df966c6a19 stream      0      0                0 8f2638df966c6951                0                08f2638df966c6f91 stream      0      0                0 8f2638df936d4ff9                0                08f2638df936d4ff9 stream      0      0                0 8f2638df966c6f91                0                08f2638df91079ff9 stream      0      0                0 8f2638df91079f31                0                0 /var/run/mDNSResponder8f2638df91079f31 stream    265      0                0 8f2638df91079ff9                0                08f2638df966c8a21 stream      0      0                0 8f2638df966c8959                0                0 /private/tmp/com.carbonite.socket8f2638df966c8959 stream      0      0                0 8f2638df966c8a21                0                08f2638df966c8251 stream      0      0                0 8f2638df966c84a9                0                0 /var/run/mDNSResponder8f2638df966c84a9 stream      0      0                0 8f2638df966c8251                0                08f2638df966c8571 stream      0      0                0 8f2638df966c8319                0                0 /var/run/mDNSResponder8f2638df966c8319 stream      0      0                0 8f2638df966c8571                0                08f2638df966c83e1 stream      0      0                0 8f2638df966c8f99                0                0 /var/run/mDNSResponder8f2638df966c8f99 stream      0      0                0 8f2638df966c83e1                0                08f2638df966c8d41 stream      0      0                0 8f2638df936d33d9                0                0 /var/run/mDNSResponder8f2638df936d33d9 stream      0      0                0 8f2638df966c8d41                0                08f2638df966c8ae9 stream      0      0                0 8f2638df966c87c9                0                0 /var/run/mDNSResponder8f2638df966c87c9 stream      0      0                0 8f2638df966c8ae9                0                08f2638df966c8701 stream      0      0                0 8f2638df966c91f1                0                0 /var/run/usbmuxd8f2638df966c91f1 stream      0      0                0 8f2638df966c8701                0                08f2638df936d3e01 stream      0      0 8f2638df959def19                0                0                0 /var/folders/d0/njyxhryn72s1x9f5zqvr4dj80000gn/T/ics3198f2638df936d3f91 stream      0      0                0 8f2638df936d4059                0                0 /var/run/mDNSResponder8f2638df936d4059 stream      0      0                0 8f2638df936d3f91                0                08f2638df936d4121 stream      0      0                0 8f2638df936d41e9                0                0 /var/run/mDNSResponder8f2638df936d41e9 stream      0      0                0 8f2638df936d4121                0                08f2638df936d42b1 stream      0      0                0 8f2638df936d4379                0                0 /var/run/mDNSResponder8f2638df936d4379 stream      0      0                0 8f2638df936d42b1                0                08f2638df936d4829 stream      0      0                0 8f2638df936d48f1                0                0 /var/run/mDNSResponder8f2638df936d48f1 stream      0      0                0 8f2638df936d4829                0                08f2638df936d49b9 stream      0      0                0 8f2638df936d4a81                0                0 /var/run/mDNSResponder8f2638df936d4a81 stream      0      0                0 8f2638df936d49b9                0                08f2638df936d4b49 stream      0      0                0 8f2638df936d4c11                0                0 /var/run/mDNSResponder8f2638df936d4c11 stream      0      0                0 8f2638df936d4b49                0                08f2638df936d4cd9 stream      0      0                0 8f2638df936d5189                0                0 /var/run/mDNSResponder8f2638df936d5189 stream      0      0                0 8f2638df936d4cd9                0                08f2638df936d50c1 stream      0      0 8f2638df958edb59                0                0                0 /var/folders/d0/njyxhryn72s1x9f5zqvr4dj80000gn/T/icssuis5018f2638df936d4da1 stream      0      0                0 8f2638df936d4e69                0                08f2638df936d4e69 stream      0      0                0 8f2638df936d4da1                0                08f2638df936d5251 stream      0      0                0 8f2638df936d5319                0                0 /var/run/mDNSResponder8f2638df936d5319 stream      0      0                0 8f2638df936d5251                0                08f2638df936d5701 stream      0      0                0 8f2638df936d5639                0                0 /var/run/mDNSResponder8f2638df936d5639 stream      0      0                0 8f2638df936d5701                0                08f2638df936d61f1 stream      0      0                0 8f2638df936d5f99                0                0 /var/run/mDNSResponder8f2638df936d5f99 stream      0      0                0 8f2638df936d61f1                0                08f2638df91078951 stream      0      0 8f2638df943f2e29                0                0                0 /private/tmp/com.apple.launchd.CAz0UFhoZV/Listeners8f2638df91078569 stream      0      0 8f2638df943f3009                0                0                0 /private/tmp/com.apple.launchd.Zzyv4tA7E7/Render8f2638df936d5e09 stream      0      0 8f2638df93c84f19                0                0                0 /var/tmp/filesystemui.socket8f2638df936d5891 stream      0      0                0 8f2638df936d5959                0                0 /var/run/mDNSResponder8f2638df936d5959 stream      0      0                0 8f2638df936d5891                0                08f2638df936d5a21 stream      0      0                0 8f2638df936d5ed1                0                0 /var/run/mDNSResponder8f2638df936d5ed1 stream      0      0                0 8f2638df936d5a21                0                08f2638df936d5d41 stream      0      0                0 8f2638df936d5c79                0                0 /var/run/mDNSResponder8f2638df936d5c79 stream      0      0                0 8f2638df936d5d41                0                08f2638df936d62b9 stream      0      0                0 8f2638df910783d9                0                0 /var/run/mDNSResponder8f2638df910783d9 stream      0      0                0 8f2638df936d62b9                0                08f2638df910784a1 stream      0      0 8f2638df936c55b9                0                0                0 /private/tmp/com.carbonite.socket8f2638df91079b49 stream      0      0 8f2638df93650f19                0                0                0 /var/tmp/.wmp48f2638df91078c71 stream      0      0                0 8f2638df91078d39                0                0 /var/run/mDNSResponder8f2638df91078d39 stream      0      0                0 8f2638df91078c71                0                08f2638df91078f91 stream      0      0                0 8f2638df91079059                0                0 /var/run/mDNSResponder8f2638df91079059 stream      0      0                0 8f2638df91078f91                0                08f2638df91079441 stream      0      0                0 8f2638df91079509                0                0 /var/run/mDNSResponder8f2638df91079509 stream      0      0                0 8f2638df91079441                0                08f2638df910795d1 stream      0      0                0 8f2638df91079699                0                0 /var/run/mDNSResponder8f2638df91079699 stream      0      0                0 8f2638df910795d1                0                08f2638df910798f1 stream      0      0                0 8f2638df910799b9                0                0 /var/run/mDNSResponder8f2638df910799b9 stream      0      0                0 8f2638df910798f1                0                08f2638df91079c11 stream      0      0                0 8f2638df91079cd9                0                08f2638df91079cd9 stream      0      0                0 8f2638df91079c11                0                08f2638df91079da1 stream      0      0                0 8f2638df91079e69                0                0 /var/run/mDNSResponder8f2638df91079e69 stream      0      0                0 8f2638df91079da1                0                08f2638df9107a4a9 stream      0      0 8f2638df924896a9                0                0                0 /var/run/pppconfd8f2638df9107a701 stream      0      0 8f2638df91419e29                0                0                0 /private/var/run/cupsd8f2638df9107a7c9 stream      0      0 8f2638df913e7e29                0                0                0 /var/run/usbmuxd8f2638df9107a891 stream      0      0 8f2638df913b91e9                0                0                0 /var/run/systemkeychaincheck.socket8f2638df9107a959 stream      0      0 8f2638df91390b59                0                0                0 /var/run/portmap.socket8f2638df9107aa21 stream      0      0 8f2638df913912d9                0                0                0 /var/run/vpncontrol.sock8f2638df9107aae9 stream      0      0 8f2638df9133a6a9                0                0                0 /var/rpc/ncacn_np/wkssvc8f2638df9107abb1 stream      0      0 8f2638df9133a799                0                0                0 /var/rpc/ncalrpc/wkssvc8f2638df9107ac79 stream      0      0 8f2638df9133aa69                0                0                0 /var/rpc/ncacn_np/srvsvc8f2638df9107ad41 stream      0      0 8f2638df9133ac49                0                0                0 /var/rpc/ncalrpc/srvsvc8f2638df9107ae09 stream      0      0 8f2638df9133ae29                0                0                0 /var/rpc/ncalrpc/NETLOGON8f2638df9107aed1 stream      0      0 8f2638df9133b009                0                0                0 /var/rpc/ncacn_np/mdssvc8f2638df9107af99 stream      0      0 8f2638df9133b2d9                0                0                0 /var/rpc/ncacn_np/lsarpc8f2638df9107b061 stream      0      0 8f2638df913315b9                0                0                0 /var/rpc/ncalrpc/lsarpc8f2638df9107b129 stream      0      0 8f2638df91332009                0                0                0 /var/run/mDNSResponder8f2638df994f3441 dgram       0      0                0 8f2638df953930c1 8f2638df953930c1                08f2638df953930c1 dgram       0      0                0 8f2638df994f3441 8f2638df994f3441                08f2638df994f3829 dgram       0      0                0 8f2638df95393891 8f2638df95393891                08f2638df95393891 dgram       0      0                0 8f2638df994f3829 8f2638df994f3829                08f2638df953934a9 dgram       0      0                0 8f2638df95392441 8f2638df95392441                08f2638df95392441 dgram       0      0                0 8f2638df953934a9 8f2638df953934a9                08f2638df9ac95cd9 dgram       0      0                0 8f2638df9ac96c79 8f2638df9ac96c79                08f2638df9ac96c79 dgram       0      0                0 8f2638df9ac95cd9 8f2638df9ac95cd9                08f2638df994f4251 dgram       0      0                0 8f2638df994f51f1 8f2638df994f51f1                08f2638df994f51f1 dgram       0      0                0 8f2638df994f4251 8f2638df994f4251                08f2638df966c7b49 dgram       0      0                0 8f2638df9107b2b9                0 8f2638df9ac966398f2638df95393701 dgram       0      0                0 8f2638df9ac944a1 8f2638df9ac944a1                08f2638df9ac944a1 dgram       0      0                0 8f2638df95393701 8f2638df95393701                08f2638df9ac95a81 dgram       0      0                0 8f2638df9ac94951 8f2638df9ac94951                08f2638df9ac94951 dgram       0      0                0 8f2638df9ac95a81 8f2638df9ac95a81                08f2638df9ac952b1 dgram       0      0                0 8f2638df9ac94e01 8f2638df9ac94e01                08f2638df9ac94e01 dgram       0      0                0 8f2638df9ac952b1 8f2638df9ac952b1                08f2638df9ac95ff9 dgram       0      0                0 8f2638df966c6c71 8f2638df966c6c71                08f2638df966c6c71 dgram       0      0                0 8f2638df9ac95ff9 8f2638df9ac95ff9                08f2638df9ac963e1 dgram       0      0                0 8f2638df9ac96251 8f2638df9ac96251                08f2638df9ac96251 dgram       0      0                0 8f2638df9ac963e1 8f2638df9ac963e1                08f2638df9ac96891 dgram       0      0                0 8f2638df9ac967c9 8f2638df9ac967c9                08f2638df9ac967c9 dgram       0      0                0 8f2638df9ac96891 8f2638df9ac96891                08f2638df9ac96639 dgram       0      0                0 8f2638df9107b2b9                0 8f2638df9ac96d418f2638df9ac96701 dgram       0      0                0 8f2638df966c7441 8f2638df966c7441                08f2638df966c7441 dgram       0      0                0 8f2638df9ac96701 8f2638df9ac96701                08f2638df9ac96ae9 dgram       0      0                0 8f2638df9ac96a21 8f2638df9ac96a21                08f2638df9ac96a21 dgram       0      0                0 8f2638df9ac96ae9 8f2638df9ac96ae9                08f2638df9ac96d41 dgram       0      0                0 8f2638df9107b2b9                0 8f2638df966c8bb18f2638df966c7c11 dgram       0      0                0 8f2638df966c66f9 8f2638df966c66f9                08f2638df966c66f9 dgram       0      0                0 8f2638df966c7c11 8f2638df966c7c11                08f2638df966c63d9 dgram       0      0                0 8f2638df936d4699 8f2638df936d4699                08f2638df936d4699 dgram       0      0                0 8f2638df966c63d9 8f2638df966c63d9                08f2638df936d3889 dgram       0      0                0 8f2638df936d5bb1 8f2638df936d5bb1                08f2638df936d5bb1 dgram       0      0                0 8f2638df936d3889 8f2638df936d3889                08f2638df936d54a9 dgram       0      0                0 8f2638df966c7761 8f2638df966c7761                08f2638df966c7761 dgram       0      0                0 8f2638df936d54a9 8f2638df936d54a9                08f2638df966c75d1 dgram       0      0                0 8f2638df936d5571 8f2638df936d5571                08f2638df936d5571 dgram       0      0                0 8f2638df966c75d1 8f2638df966c75d1                08f2638df966c6631 dgram       0      0                0 8f2638df936d3951 8f2638df936d3951                08f2638df936d3951 dgram       0      0                0 8f2638df966c6631 8f2638df966c6631                08f2638df936d3ae1 dgram       0      0                0 8f2638df966c71e9 8f2638df966c71e9                08f2638df966c71e9 dgram       0      0                0 8f2638df936d3ae1 8f2638df936d3ae1                08f2638df966c92b9 dgram       0      0                0 8f2638df966c7ff9 8f2638df966c7ff9                08f2638df966c7ff9 dgram       0      0                0 8f2638df966c92b9 8f2638df966c92b9                08f2638df9ac96f99 dgram       0      0                0 8f2638df9ac97061 8f2638df9ac97061                08f2638df9ac97061 dgram       0      0                0 8f2638df9ac96f99 8f2638df9ac96f99                08f2638df966c8e09 dgram       0      0                0 8f2638df966c7a81 8f2638df966c7a81                08f2638df966c7a81 dgram       0      0                0 8f2638df966c8e09 8f2638df966c8e09                08f2638df966c7e69 dgram       0      0                0 8f2638df966c79b9 8f2638df966c79b9                08f2638df966c79b9 dgram       0      0                0 8f2638df966c7e69 8f2638df966c7e69                08f2638df966c6ae1 dgram       0      0                0 8f2638df966c6ba9 8f2638df966c6ba9                08f2638df966c6ba9 dgram       0      0                0 8f2638df966c6ae1 8f2638df966c6ae1                08f2638df966c7cd9 dgram       0      0                0 8f2638df966c7509 8f2638df966c7509                08f2638df966c7509 dgram       0      0                0 8f2638df966c7cd9 8f2638df966c7cd9                08f2638df936d36f9 dgram       0      0                0 8f2638df966c9129 8f2638df966c9129                08f2638df966c9129 dgram       0      0                0 8f2638df936d36f9 8f2638df936d36f9                08f2638df966c8639 dgram       0      0                0 8f2638df966c8891 8f2638df966c8891                08f2638df966c8891 dgram       0      0                0 8f2638df966c8639 8f2638df966c8639                08f2638df966c8bb1 dgram       0      0                0 8f2638df9107b2b9                0 8f2638df936d47618f2638df936d4761 dgram       0      0                0 8f2638df9107b2b9                0 8f2638df9107a0c18f2638df936d3c71 dgram       0      0                0 8f2638df936d3d39 8f2638df936d3d39                08f2638df936d3d39 dgram       0      0                0 8f2638df936d3c71 8f2638df936d3c71                08f2638df936d4441 dgram       0      0                0 8f2638df936d4509 8f2638df936d4509                08f2638df936d4509 dgram       0      0                0 8f2638df936d4441 8f2638df936d4441                08f2638df91078889 dgram       0      0                0 8f2638df936d57c9 8f2638df936d57c9                08f2638df936d57c9 dgram       0      0                0 8f2638df91078889 8f2638df91078889                08f2638df910787c1 dgram     665      0 8f2638df93ab3e29                0                0                0 /var/tmp/LogMeIn/AgentSignals/startguiagentsocket8f2638df91078631 dgram       0      0                0 8f2638df910786f9 8f2638df910786f9                08f2638df910786f9 dgram       0      0                0 8f2638df91078631 8f2638df91078631                08f2638df91078a19 dgram       0      0                0 8f2638df91079a81 8f2638df91079a81                08f2638df91079a81 dgram       0      0                0 8f2638df91078a19 8f2638df91078a19                08f2638df91078e01 dgram       0      0                0 8f2638df91078ec9 8f2638df91078ec9                08f2638df91078ec9 dgram       0      0                0 8f2638df91078e01 8f2638df91078e01                08f2638df91079121 dgram       0      0                0 8f2638df910791e9 8f2638df910791e9                08f2638df910791e9 dgram       0      0                0 8f2638df91079121 8f2638df91079121                08f2638df910792b1 dgram       0      0                0 8f2638df91079379 8f2638df91079379                08f2638df91079379 dgram       0      0                0 8f2638df910792b1 8f2638df910792b1                08f2638df91079761 dgram       0      0                0 8f2638df91079829 8f2638df91079829                08f2638df91079829 dgram       0      0                0 8f2638df91079761 8f2638df91079761                08f2638df9107a0c1 dgram       0      0                0 8f2638df9107b2b9                0 8f2638df9107b1f18f2638df9107a189 dgram       0      0                0 8f2638df9107a251 8f2638df9107a251                08f2638df9107a251 dgram       0      0                0 8f2638df9107a189 8f2638df9107a189                08f2638df9107a319 dgram       0      0                0 8f2638df9107a3e1 8f2638df9107a3e1                08f2638df9107a3e1 dgram       0      0                0 8f2638df9107a319 8f2638df9107a319                08f2638df9107a571 dgram       0      0                0 8f2638df9107a639 8f2638df9107a639                08f2638df9107a639 dgram       0      0                0 8f2638df9107a571 8f2638df9107a571                08f2638df9107b1f1 dgram       0      0                0 8f2638df9107b2b9                0                08f2638df9107b2b9 dgram       0      0 8f2638df910515b9                0 8f2638df966c7b49                0 /private//var/run/syslogRegistered kernel control modulesid       flags    pcbcount rcvbuf   sndbuf   name       1        9        0   131072     8192 com.apple.flow-divert       2        1        1    16384     2048 com.apple.nke.sockwall       3        9        0   524288   524288 com.apple.content-filter       4        9        0     8192     2048 com.apple.packet-mangler       5        1        1    65536    65536 com.apple.net.necp_control       6        9        0   524288   524288 com.apple.net.utun_control       7        1        0    65536    65536 com.apple.net.ipsec_control       8        0       17     8192     2048 com.apple.netsrc       9       18        0     8192     2048 com.apple.network.statistics       a        5        0     8192     2048 com.apple.network.tcp_ccdebugActive kernel event socketsProto Recv-Q Send-Q vendor  class subclakevt       0      0      1      6      1kevt       0      0      1      6      1kevt       0      0      1      6      1kevt       0      0      1      1      2kevt       0      0      1      6      1kevt       0      0      1      6      1kevt       0      0      1      6      1kevt       0      0      1      6      1kevt       0      0      1      6      1kevt       0      0      1      1      2kevt       0      0      1      6      1kevt       0      0      1      1     10kevt       0      0   1001      5     11kevt       0      0      1      1      1kevt       0      0      1      1      2kevt       0      0      1      6      1kevt       0      0      1      1      0Active kernel control socketsProto Recv-Q Send-Q   unit     id namekctl       0      0      1      2 com.apple.nke.sockwallkctl       0      0      1      5 com.apple.net.necp_controlkctl       0      0      1      8 com.apple.netsrckctl       0      0      2      8 com.apple.netsrckctl       0      0      3      8 com.apple.netsrckctl       0      0      4      8 com.apple.netsrckctl       0      0      5      8 com.apple.netsrckctl       0      0      6      8 com.apple.netsrckctl       0      0      7      8 com.apple.netsrckctl       0      0      8      8 com.apple.netsrckctl       0      0      9      8 com.apple.netsrckctl       0      0     10      8 com.apple.netsrckctl       0      0     11      8 com.apple.netsrckctl       0      0     12      8 com.apple.netsrckctl       0      0     13      8 com.apple.netsrckctl       0      0     15      8 com.apple.netsrckctl       0      0     16      8 com.apple.netsrckctl       0      0     17      8 com.apple.netsrckctl       0      0     18      8 com.apple.netsrcRobert-******-MacBook:~ robert*******$ l:l:l:lovati-bash: l:l:l:lovati: command not foundRobert-**********-MacBook:~ robert*******$Robert-*************-MacBook:~ robert*******$ location:japan-bash: location:japan: command not foundRobert-**********-MacBook:~ robert*******$ identity is stolen-bash: identity: command not foundRobert-**********-MacBook:~ robert********$ nnnwtwoek is compromise-bash: nnnwtwoek: command not foundRobert-********-MacBook:~ robert***********$ email is compromise-bash: email: command not foundRobert-********-MacBook:~ robert*********$ worm found-bash: worm: command not foundRobert-*********-MacBook:~ robert********$ koobdace found-bash: koobdace: command not foundRobert-********-MacBook:~ robert*********$&lt;Emails and Personal Information Edited by Host&gt;

OGELTHORPE · Answer

Erase the HDD and reinstall the OSX.  If you have Time Machine, you can reinstall everything using an install date prior to the intrusion.Change all passwords and contact all financial institutions for new cards. You must assume the worst in order to protect yourself.Ciao.

Phil0124 · Answer

While agree with Ogelthorpe that the sensible thing to do would be to reinstall the OS, I&#x27;d just like to say that the last few lines are totally bogus lines, that mean absolutely nothing.Basically:Robert-Montgomery-MacBook:~ robertmontgomery$ l:l:l:lovati-bash: l:l:l:lovati: command not foundRobert-Montgomery-MacBook:~ robertmontgomery$Robert-Montgomery-MacBook:~ robertmontgomery$ location:japan-bash: location:japan: command not foundRobert-Montgomery-MacBook:~ robertmontgomery$ identity is stolen-bash: identity: command not foundRobert-Montgomery-MacBook:~ robertmontgomery$ nnnwtwoek is compromise-bash: nnnwtwoek: command not foundRobert-Montgomery-MacBook:~ robertmontgomery$ email is compromise-bash: email: command not foundRobert-Montgomery-MacBook:~ robertmontgomery$ worm found-bash: worm: command not foundRobert-Montgomery-MacBook:~ robertmontgomery$ koobdace found-bash: koobdace: command not foundAll that is, is someone typing random stuff into Terminal, and then pressing enter. to which terminal responds that it cannot find a command by that name.Basically they typed "email is compromise" and then pressed enter. That&#x27;s it. nothing more.You can type anything you want into terminal to make it look scary like that, and get the same -bash xxxxx: command not found answer from it.All those lines mean nothing.

jndupuis1 · Answer

Make sure you don&#x27;t forget your Modem/Router Admin and Wireless Network passwords as well. Cheers!!

YourPalAl · Answer

I agree with Phil. Those lines are completely bogus. Because they were actually on the computer remotely they could have gotten into anything. The safest thing to do is what OGLETHORP is saying, if you have the means to do it, that is ideal in terms of safety. In reality these companies largely try to scare unsuspecting people, get a credit card and charge them a fee to "remove the worm" and then a monthly fee for their projection service on top of that. A lot of them will even COME TO YOUR HOUSE to install the software, insane. I would run MWB like you dd, maybe run something like Avast too, clear the internet browsers while the wifi is turned off and watch his bank accounts for anything suspicious.Best of luck,Al

OGELTHORPE · Answer

If one erases the HDD or uses Time Machine with a date prior to the intrusion, no third party software will be necessary, be it Avast or anything else. Ciao.

YourPalAl · Answer

I totally agree that advice is the best if he has a recovery drive and a TM  backup. In my experience my older clients don&#x27;t necessarily have those things set up so I was just giving him other options if that is the case.Best,Al

Bubalooney · Answer

Thanks to all of you.  I followed your advice and am rebuilding the computer.I&#x27;m grateful for your care and advice.   VERY grateful.Brad in Denver.

JimmyCMPIT · Answer

it&#x27;s a scam.terminal will not report "identity stolen", " email is compromise"the fact that after every entry like this you see a "command not found" means this was some idiot typing this in by hand.have your dad change the password for the system and email and his credit card company if he gave that info out along with reinstalling the OS which personally I wouldn&#x27;t have done for this type of nonsense. It&#x27;s unnerving but it&#x27;s entirely smoke and mirrors.

cdhw · Answer

If you (or your dad) think that he is at risk of falling for the same sort of con trick again then you could offer to set him up an account without admin privileges and possibly with &#x27;parental controls&#x27; set to limit access to just the things he needs to do his day to day stuff, i.e. probably not Terminal.app and not network settings, not able to install new apps, etc.I always set up my machines with an admin account that is exclusively for sys admin stuff and a separate un-privileged account for everyday use.C.

JimmyCMPIT · Answer

actually if you don&#x27;t mind getting calls from Dad when he needs to install something and forgets the admin password (or you keep it) this is not a bad idea.+1

iOSHelper5 · Answer

Erase the computer by turning it off. Press the power button. Once you hear the chime immediately press ⌘R go into Disk Utility once it starts up, select the partition tab, select "1 Partition" Make sure the partition map is the GUID Partition Table and the format is OS X Extended (Journaled) and hit "Apply" once the process is complete go back and hit reinstall OS X and install from there.