IMac (Mavericks) hacked by remote user

Question

A couple of weeks ago I noticed my camera on - as I approached the computer it shut off. I thought that maybe a family member started to facetime me and change their mind (there was no ringing) That happened 2 times. I forgot to ask anyone about it.
A week later, my PayPal account was broken into, as was my bank account connected to PayPal. They took more than $2000.00. PayPal has not yet explained how this happened.
3 days ago, early on Sunday morning, I saw my computer screen lit up and all these windows opening and closing. At first I was unsure that I was actually seeing what was happening. Then I bumped the mouse and the windows started to close...fast. It finally hit me that someone was "there." I turned off the wifi (no cable connected) - then I went to the trash to see what was there -- nothing. So I opened up the browser history and saw all my bank accounts listed. I checked my e-mail and saw all these alerts from my banks stating that someone had incorrectly answered the security questions -- in 4 banks. the DID get into an old credit card account online. I communicated with all my banks. I also have emailed DYN.com as I use(d) their services for years -- as a paid subscriber, I thought they would respond to me -- I was wondering if that is how the remote access occurred. I have heard nothing from them either...
I looked in settings and there was an added user "Mrs Tester" was added as an admin. I deleted the account, unchecked remote login and screen share. I also changed my home network code and base station code.  I NEED remote login for my work.  I called Apple security and the guy told me that I had already done everything they would tell me to do. I have the hackers history. (bitcoins were the accounts he was going back to after each attempt at a bank) -- Of course I have changed all my pass codes and made them all unique -- do I call the police? How can I tell if my computer is safe again.
So there's my question...how do I scan to see if there's anything on  my system logging my key strokes etc. I installed "eset" trial user, as was recommended by the local computer store.   Any other thoughts? With all the password changes, is there a way I can get back online and use remote login?
I have to say, I feel like a naked man has been staring at me from outside my window... YUCK.
Thanks for your help...

Answer 1

Of course I have changed all my pass codes and made them all unique — I filed a police report.  I was starting to feel better about all this when 2 days ago someone successfully logged in and changed my Social Security account password. I changed it again nd changed the email that went with it. I called SS and asked how this could have happened. She was so laissez fair about the entire thing. Said “hon, it’s OKAY!”  That’s it. She said because I have no bank account attached to it, it didn't matter -- Don't they now have all my identity stuff?  When I logged in to change the password after receiving an email alert, I saw a very quick flash across the screen that read something like "Someone may be watching you" I couldn't get it to repeat. 
How can I tell if my computer is safe again.
So there's my question...how do I scan to see if there's anything on  my system logging my key strokes etc.  Any other thoughts? With all the password changes, is there a way I can get back online and use remote login?
Now, also, JAVA has been removed (or was never installed?!) on my MB Air and many things will not run. Even airline websites to book flights need java.  I have now updated JAVA on my iMac (the computer where I saw the hacker working) -
Here is the log -- THANKS!
Start time: 17:13:21 06/22/14
Model Identifier: iMac13,1
System Version: OS X 10.9.3 (13D65)
Kernel Version: Darwin 13.2.0
Boot Mode: Normal
Time since boot: 3 days 10:12
USB
  Photosmart C4200 series (Hewlett Packard)
  LaCie Device (LaCie)
  USB2.0 Hub (Genesys Logic, Inc.)
  USB2.0 Hub (Genesys Logic, Inc.)
  MT1887 (MediaTek Inc.)
Diagnostic reports
  2013-11-17  crash
  2014-05-25 dyn_updater crash
  2014-06-02 ExpanderDaemon crash
  2014-06-02 Kernel panic
  2014-06-02 Kernel panic
  2014-06-02 Kernel panic
  2014-06-03 esets_proxy crash
  2014-06-05 CarboniteDaemon crash
  2014-06-06 Mail crash
  2014-06-09 Google Drive crash
  2014-06-13 CarboniteDaemon crash
  2014-06-13 Mail crash
  2014-06-20 AppleFileServer crash
Log
  Jun 18 19:02:51 wl0: Roamed or switched channel, reason #4, bssid 20
  Jun 19 07:03:50 process CarboniteDaemon[116] thread 3699 caught burning CPU! It used more than 50% CPU (Actual recent usage: 92%) over 180 seconds. thread lifetime cpu usage 90.030437 seconds, (88.341544 user, 1.688893 system) ledger info: balance: 90005043742 credit: 90005043742 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 96944526539
  Jun 19 09:56:02 key_getsastat: Error finding SAs.
  Jun 19 09:56:35 key_getsastat: Error finding SAs.
  Jun 19 09:57:05 key_getsastat: Error finding SAs.
  Jun 19 09:57:13 ip6_output (ipsec): error code 22
  Jun 19 09:57:38 key_getsastat: Error finding SAs.
  Jun 19 09:58:08 key_getsastat: Error finding SAs.
  Jun 19 09:58:41 key_getsastat: Error finding SAs.
  Jun 19 09:59:14 key_getsastat: Error finding SAs.
  Jun 19 09:59:47 key_getsastat: Error finding SAs.
  Jun 19 10:00:20 key_getsastat: Error finding SAs.
  Jun 19 10:00:53 key_getsastat: Error finding SAs.
  Jun 19 10:01:26 key_getsastat: Error finding SAs.
  Jun 19 10:01:59 key_getsastat: Error finding SAs.
  Jun 19 10:02:32 key_getsastat: Error finding SAs.
  Jun 19 10:03:05 key_getsastat: Error finding SAs.
  Jun 19 10:03:35 key_getsastat: Error finding SAs.
  Jun 19 10:04:08 key_getsastat: Error finding SAs.
  Jun 19 10:04:41 key_getsastat: Error finding SAs.
  Jun 19 10:05:14 key_getsastat: Error finding SAs.
  Jun 19 11:04:22 process Mail[581] thread 177641 caught burning CPU! It used more than 50% CPU (Actual recent usage: 54%) over 180 seconds. thread lifetime cpu usage 90.036547 seconds, (89.425471 user, 0.611076 system) ledger info: balance: 90000865602 credit: 90000865602 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 165132323665
  Jun 19 15:33:14 ip6_output (ipsec): error code 22
  Jun 20 19:56:37 esp6_input: mbuf allocation failed
  Jun 21 10:24:59 process Acrobat[19068] caught causing excessive wakeups. Observed wakeups rate (per sec): 209; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 359644
Activity
  CPU: user 20%, system 6%
CPU per process: CarboniteDaemon (UID 0) is using 75.2  %
Daemons
  com.oracle.java.Java-Updater
  com.oracle.java.JavaUpdateHelper
  com.rim.BBDaemon
  com.oracle.java.Helper-Tool
  com.microsoft.office.licensing.helper
  PenCommService
  com.google.keystone.daemon
  com.flipvideo.FlipShareServer.launchd
  com.fitbit.galileod
  com.fitbit.fitbitd
  com.carbonite.daemon
  com.adobe.SwitchBoard
  com.adobe.fpsaud
Agents
  com.hp.scanModule.68672.UUID
  2BUA8C4S2C.com.agilebits.Apassword-helper
  net.culater.SIMBL.Agent
  com.rim.BBLaunchAgent
  com.puredigitaltechnologies.FlipShareAutoRun
  com.oracle.java.Java-Updater
  com.hp.help.tocgenerator
  com.google.keystone.system.agent
  com.flipvideo.FlipShareAutoRun
  com.coupons.coupond
  com.carbonite.carbonitestatus
  com.carbonite.carbonitealerts
  com.adobe.CS5ServiceManager
  com.google.Chrome.framework.service_process~/Library/Application_Support/Google /Chrome
  com.facebook.videochat.updater
  com.akamai.single-user-client
  com.akamai.client.plist
  com.adobe.ARM.UUID
launchd
  /System/Library/LaunchAgents/com.apple.AirPortBaseStationAgent.plist
  (com.apple.AirPortBaseStationAgent)
  /System/Library/LaunchAgents/com.apple.servernotifyd.plist
  (com.apple.servernotifyd)
  /Library/LaunchAgents/com.adobe.AAM.Updater-1.0.plist
  (com.adobe.AAM.Startup-1.0)
  /Library/LaunchAgents/com.adobe.CS5ServiceManager.plist
  (com.adobe.CS5ServiceManager)
  /Library/LaunchAgents/com.carbonite.launchd.carbonitealerts.plist
  (com.carbonite.carbonitealerts)
  /Library/LaunchAgents/com.carbonite.launchd.carbonitestatus.plist
  (com.carbonite.carbonitestatus)
  /Library/LaunchAgents/com.coupons.coupond.plist
  (com.coupons.coupond)
  /Library/LaunchAgents/com.flipvideo.FlipShare.AutoRun.plist
  (com.flipvideo.FlipShareAutoRun)
  /Library/LaunchAgents/com.google.keystone.agent.plist
  (com.google.keystone.system.agent)
  /Library/LaunchAgents/com.hp.help.tocgenerator.plist
  (com.hp.help.tocgenerator)
  /Library/LaunchAgents/com.oracle.java.Java-Updater.plist
  (com.oracle.java.Java-Updater)
  /Library/LaunchAgents/com.puredigitaltechnologies.FlipShare.AutoRun.plist
  (com.puredigitaltechnologies.FlipShareAutoRun)
  /Library/LaunchAgents/com.rim.BBLaunchAgent.plist
  (com.rim.BBLaunchAgent)
  /Library/LaunchAgents/net.culater.SIMBL.Agent.plist
  (net.culater.SIMBL.Agent)
  /Library/LaunchDaemons/com.adobe.fpsaud.plist
  (com.adobe.fpsaud)
  /Library/LaunchDaemons/com.adobe.SwitchBoard.plist
  (com.adobe.SwitchBoard)
  /Library/LaunchDaemons/com.carbonite.launchd.carbonitedaemon.plist
  (com.carbonite.daemon)
  /Library/LaunchDaemons/com.fitbit.fitbitd.plist
  (com.fitbit.fitbitd)
  /Library/LaunchDaemons/com.fitbit.galileod.plist
  (com.fitbit.galileod)
  /Library/LaunchDaemons/com.flipvideo.FlipShareServer.launchd.plist
  (com.flipvideo.FlipShareServer.launchd)
  /Library/LaunchDaemons/com.google.keystone.daemon.plist
  (com.google.keystone.daemon)
  /Library/LaunchDaemons/com.livescribe.PenCommService.plist
  (PenCommService)
  /Library/LaunchDaemons/com.microsoft.office.licensing.helper.plist
  (com.microsoft.office.licensing.helper)
  /Library/LaunchDaemons/com.oracle.java.Helper-Tool.plist
  (com.oracle.java.Helper-Tool)
  /Library/LaunchDaemons/com.oracle.java.JavaUpdateHelper.plist
  (com.oracle.java.JavaUpdateHelper)
  /Library/LaunchDaemons/com.rim.BBDaemon.plist
  (com.rim.BBDaemon)
  Library/LaunchAgents/com.adobe.ARM.UUID.plist
  (com.adobe.ARM.UUID)
  Library/LaunchAgents/com.akamai.client.plist
  (com.akamai.client.plist)
  Library/LaunchAgents/com.akamai.single-user-client.plist
  (com.akamai.single-user-client)
  Library/LaunchAgents/com.apple.FolderActions.enabled.plist
  (com.apple.FolderActions.enabled)
  Library/LaunchAgents/com.apple.FolderActions.folders.plist
  (com.apple.FolderActions.folders)
  Library/LaunchAgents/com.facebook.videochat.plist
  (com.facebook.videochat.updater)
  Library/LaunchAgents/com.google.Chrome.framework.plist
  (com.google.Chrome.framework.service_process~/Library/Application_Support/Googl e/Chrome)
  Library/LaunchAgents/ws.agile.APasswordAgent.plist
  (ws.agile.APasswordAgent)
Startup items
  /Library/StartupItems/DoubleCommand/config.command
  /Library/StartupItems/DoubleCommand/DoubleCommand
  /Library/StartupItems/DoubleCommand/install.command
  /Library/StartupItems/DoubleCommand/login.command
  /Library/StartupItems/DoubleCommand/StartupParameters.plist
  /Library/StartupItems/DoubleCommand/uninstall.command
  /Library/StartupItems/HP IO/HP IO
  /Library/StartupItems/HP IO/Resources/version.plist
  /Library/StartupItems/HP IO/StartupParameters.plist
  /Library/StartupItems/Qmaster/Qmaster
  /Library/StartupItems/Qmaster/StartupParameters.plist
Bundles
  /System/Library/Extensions/LivescribeSmartpen.kext
  (com.livescribe.kext.LivescribeSmartpen)
  /System/Library/Extensions/MacOSXCameraDriver.kext
  (com.flipvideo.IOUSBCameraMassStorage)
  /System/Library/Extensions/RIMBBUSB.kext
  (com.rim.driver.BlackBerryUSBDriverInt)
  /System/Library/Extensions/RIMBBVSP.kext
  (com.rim.driver.BlackBerryUSBDriverVSP)
  /System/Library/Extensions/SiLabsUSBDriver.kext
  (com.silabs.driver.SiLabsUSBDriver)
  /System/Library/Extensions/VaraAudio.kext
  (com.vara.driver.VaraAudio)
  /Library/Audio/MIDI Drivers/EmagicUSBMIDIDriver.plugin
  (info.emagic.driver.unitor)
  /Library/Audio/Plug-Ins/Components/A52Codec.component
  (com.shepmater.A52Codec)
  /Library/Audio/Plug-Ins/Components/Flip4Mac WMA Import.component
  (net.telestream.wmv.import)
  /Library/Audio/Plug-Ins/HAL/DVCPROHDAudio.plugin
  (com.apple.DVCPROHDAudio)
  /Library/InputManagers/1PasswdIM/1PasswdIM.bundle
  (com.1passwd.InputManager)
  /Library/Internet Plug-Ins/AdobeAAMDetect.plugin
  (com.AdobeAAMDetectLib.AdobeAAMDetect)
  /Library/Internet Plug-Ins/AdobePDFViewer.plugin
  (com.adobe.acrobat.pdfviewer)
  /Library/Internet Plug-Ins/CouponPrinter-FireFox_v2.plugin
  (com.coupons.plugin.mozilla-plugin)
  /Library/Internet Plug-Ins/disabled/JavaAppletPlugin.plugin
  (com.oracle.java.JavaAppletPlugin)
  /Library/Internet Plug-Ins/DivXBrowserPlugin.plugin
  (com.divx.DivXBrowserPlugin)
  /Library/Internet Plug-Ins/eMusicRemote.plugin
  (com.emusic.plugins.emp.mac)
  /Library/Internet Plug-Ins/Flash Player.plugin
  (N/A)
  /Library/Internet Plug-Ins/Flip4Mac WMV Plugin.plugin
  (net.telestream.wmv.plugin)
  /Library/Internet Plug-Ins/Google Earth Web Plug-in.plugin
  (com.Google.GoogleEarthPlugin.plugin)
  /Library/Internet Plug-Ins/googletalkbrowserplugin.plugin
  (com.google.googletalkbrowserplugin)
  /Library/Internet Plug-Ins/iPhotoPhotocast.plugin
  (com.apple.plugin.iPhotoPhotocast)
  /Library/Internet Plug-Ins/JavaAppletPlugin.plugin
  (com.oracle.java.JavaAppletPlugin)
  /Library/Internet Plug-Ins/o1dbrowserplugin.plugin
  (com.google.o1dbrowserplugin)
  /Library/Internet Plug-Ins/OfficeLiveBrowserPlugin.plugin
  (com.microsoft.officelive.browserplugin)
  /Library/Internet Plug-Ins/RealPlayer Plugin.plugin
  (com.RealNetworks.RealPlayerPlugin)
  /Library/Internet Plug-Ins/SharePointBrowserPlugin.plugin
  (com.microsoft.sharepoint.browserplugin)
  /Library/Internet Plug-Ins/SharePointWebKitPlugin.webplugin
  (com.microsoft.sharepoint.webkitplugin)
  /Library/Internet Plug-Ins/Silverlight.plugin
  (com.microsoft.SilverlightPlugin)
  /Library/Internet Plug-Ins/SnagitSafariScroller.webplugin
  (com.techsmith.SnagitSafariScroller)
  /Library/Mail/Bundles (Disabled)/UnsubMailPluginMailAppOSX.mailbundle
  (com.unsubscribeinc.UnsubMailPluginMailAppOSX)
  /Library/PreferencePanes/3ivxPrefPane.prefPane
  (com.3ivx.prefpane)
  /Library/PreferencePanes/Carbonite.prefPane
  (com.carbonite.prefpanel)
  /Library/PreferencePanes/Flash Player.prefPane
  (com.adobe.flashplayerpreferences)
  /Library/PreferencePanes/Flip4Mac WMV.prefPane
  (net.telestream.wmv.prefpane)
  /Library/PreferencePanes/JavaControlPanel.prefPane
  (com.oracle.java.JavaControlPanel)
  /Library/PreferencePanes/MacFUSE.prefPane
  (com.google.MacFUSE)
  /Library/PreferencePanes/Perian.prefPane
  (org.perian.PerianPane)
  /Library/PreferencePanes/Tuxera NTFS.prefPane
  (com.tuxera.ntfs.mac.prefpane)
  /Library/QuickTime/AC3MovieImport.component
  (com.cod3r.ac3movieimport)
  /Library/QuickTime/AppleHDVCodec.component
  (com.apple.AppleHDVCodec)
  /Library/QuickTime/DesktopVideoOut.component
  (com.apple.DesktopVideoOut)
  /Library/QuickTime/DivX 6 Decoder.component
  (com.DivXInc.DivXDecoder)
  /Library/QuickTime/DVCPROHDCodec.component
  (com.apple.DVCPROHDCodec)
  /Library/QuickTime/DVCPROHDMuxer.component
  (com.apple.DVCPROHDMuxer)
  /Library/QuickTime/DVCPROHDVideoDigitizer.component
  (com.apple.DVCPROHDVideoDigitizer)
  /Library/QuickTime/DVCPROHDVideoOutput.component
  (com.apple.DVCPROHDVideoOutput)
  /Library/QuickTime/DVCPROHDVideoOutputClock.component
  (com.apple.DVCPROHDVideoOutputClock)
  /Library/QuickTime/DVCPROHDVideoOutputCodec.component
  (com.apple.DVCPROHDVideoOutputCodec)
  /Library/QuickTime/Flip4Mac WMV Advanced.component
  (net.telestream.wmv.advanced)
  /Library/QuickTime/Flip4Mac WMV Export.component
  (net.telestream.wmv.export)
  /Library/QuickTime/Flip4Mac WMV Import.component
  (net.telestream.wmv.import)
  /Library/QuickTime/FLV.component
  (com.theoryllc.FLVComponentBundle)
  /Library/QuickTime/IMXCodec.component
  (com.apple.IMXCodec)
  /Library/QuickTime/LiveType.component
  (com.apple.LiveType.component)
  /Library/QuickTime/Perian.component
  (org.perian.Perian)
  /Library/QuickTime/QTMpeg4Codec.component
  (com.apple.QTMpeg4Codec)
  /Library/ScriptingAdditions/Adobe Unit Types.osax
  (N/A)
  /Library/ScriptingAdditions/SIMBL.osax
  (net.culater.SIMBL.osax)
  /Library/Spotlight/GBSpotlightImporter.mdimporter
  (com.apple.garageband.spotlightimporter)
  /Library/Spotlight/Microsoft Entourage.mdimporter
  (com.microsoft.entourageMDImporter)
  /Library/Widgets/VersionTracker.wdgt
  (com.versiontracker.updates)
  Library/Address Book Plug-Ins/SkypeABDialer.bundle
  (com.skype.skypeabdialer)
  Library/Address Book Plug-Ins/SkypeABSMS.bundle
  (com.skype.skypeabsms)
  Library/Caches/com.apple.Safari/Extensions/1Password.safariextension
  (com.agilebits.onepassword4-safari)
  Library/Caches/com.apple.Safari/Extensions/Disconnect.safariextension
  (me.disconnect.disconnect)
  Library/Caches/com.apple.Safari/Extensions/DoNotTrackMe- Online Privacy Protection.safariextension
  (com.abine.dntpsafari)
  Library/Caches/com.apple.Safari/Extensions/dotdotdot.safariextension
  (com.dotdotdot.importer)
  Library/Caches/com.apple.Safari/Extensions/Omnibar.safariextension
  (com.genieo.safari)
  Library/Internet Plug-Ins/CitrixOnlineWebDeploymentPlugin.plugin
  (com.citrixonline.mac.WebDeploymentPlugin)
  Library/Internet Plug-Ins/EvernoteSafariClipperPlugin.webplugin
  (com.evernote.EvernoteSafariClipperPlugin)
  Library/Internet Plug-Ins/FacebookVideoCalling.bundle
  (com.skype.FacebookVideoCalling)
  Library/Internet Plug-Ins/fbplugin_1_0_3.plugin
  (com.facebook.plugin)
  Library/Internet Plug-Ins/Move-Media-Player.plugin
  (com.movenetworks.movemediaplayer.plugin)
  Library/Internet Plug-Ins/Picasa.plugin
  (com.google.PicasaPlugin)
  Library/iTunes/Mobile Backups/1B925U5V201/Structured
  (N/A)
  Library/PreferencePanes/AkamaiNetSession.prefPane
  (com.yourcompany.AkamaiNetSession)
  Library/PreferencePanes/AkamaiNetSession.prefPane/Contents/Resources
  (com.yourcompany.${PRODUCT_NAME)
  Library/PreferencePanes/handyPrint.prefPane
  (com.netputing.handyPrint)
  Library/Widgets/Hotcards.wdgt