Heffer Mac wrote:
What do you suggest if you granted these individuals access to your computer for 5 to 10 minutes? Is my Mac safe? What steps should I take to insure it is clean?
First, understand that the appearance of a message such as "a serious attack has been detected" or anything like it is prima facie indication of malicious intent, because the message is fraudulent. There are no remote means of determining such an "attack" took place. Then, imagine that you agreed to grant those criminals the ability to use your Mac as if it were theirs. In other words whatever you can do with your Mac they can do with your Mac, for at least the period of time they were using it, as if they were physically sitting in front of it.
Perhaps you were actively watching what they were doing, or not. Perhaps you understood what they were doing, or not. I can't be sure of any of that.
Then, understand and appreciate the fact that there are no means of determining what alterations might have been done to your Mac after the fact. None. Don't bother looking for a means of detecting that. It takes little effort and effectively no programming skill to install the equivalent of a "back door" or the equivalent thereof, conceivably allowing the criminals to remotely log in at any time in the future to do whatever it is they want. It's like giving them a key to your house.
It's possible all they sought was authorization to charge your credit card in an effort to make a quick buck, but that's easy for me to say. It's your Mac, I don't know what's on it, or the confidential information you might have to lose.
Then: decide upon an appropriate response to that intrusive event. Your actions at this point can range from doing nothing at all, to erasing the Mac and reconfiguring it. Computer tampering and identity theft are legal matters that go well beyond the scope of this support site, and for which you should seek appropriate legal counsel. Therefore I can only offer technical guidance regarding your Mac itself, which may be considered evidence in a criminal proceeding that only you can decide to take upon receiving that counsel.
At a minimum it should be immediately disconnected from the Internet (unplug its Ethernet cable and turn Wi-Fi "off") after which you can decide whether to preserve it in its present condition as evidence, or its contents completely erased, permanently removing that evidence.
Decide how you want to proceed and write back, but since this particular Discussion is old you really ought to post a new Discussion so that you can receive the individual attention you deserve. The only reason I found your reply was that I had replied to this Discussion in the past. Since it was not marked "solved" I did not unsubscribe from it. A new Discussion will enjoy much greater visibility.
