My grandfather recently fell for a telephone scam. I won't go into details into how the scam worked; it's sufficient to say that he sent them over $2000 worth of iTunes gift card codes.
The scammers walked him through installing "TeamViewer" then "helping" him with his computer (a Mac mini). "TeamViewer" is in quotes because I don't know for sure what they actually got him to install. It could have been a legitimate copy of TeamViewer, or it could have been a version of TeamViewer laced with malware. Since I don't know if his computer has been infected with anything, I'm going to have him mail the Mac mini to me. I intend to nuke it from orbit; it's the only way to be sure. I'll set him up with a non-admin account and manage it remotely.
Here's where the story takes an odd turn. The scammers called him today and requested that he turn on TeamViewer so that they could continue to "help" him. My grandfather said no, and the scammer belligerently said that he would block/disconnect his computer. I'm unsure of the details (since I couldn't see the computer), but my grandfather said that big messages appeared on his computer saying that his computer had a virus and that he needed to call a number. When he called that number, it was the scammer (no surprise). The warnings came repeatedly over the next few hours.
Here's my question: How were the scammers able to remotely trigger warning messages on his computer? If they had access, why did they need my grandfather to enable TeamViewer? If you still had access, it would be much more productive to just access it at 3am when he's asleep. If they didn't have access, how could they push the ads?
I will mostly likely receive the computer in the mail within 48 hours. Once I have it I will have a small window in which to examine it before I need to initiate the nuke. Are there any tests that I can run to check for malware?