Impressed: it has been years since I've been hacked this well :(

[David Bovill]

On 15/06/07, Brent Anderson <brentj84062 at gmail.com> wrote:

>General security practice on the Mac - Make sure your firewall is on,
> unless you are using a port keep it closed. UDP Blocking/Firewall
> Logging/Stealth Mode should be on too. The most important thing is
> that you don't visit anything questionable and that you know where
> your internet is coming from.
>
> If your ghost has any Mac sense at all and if your problem is
> recurring when you boot up, crack open a terminal and take a look at
> the file in /etc/crontab. Download Lingon from Peter Borg to
> investigate what Launchd processes are running. If you have anything
> that looks like it shouldn't belong, it probably doesn't.
>
> There's more, but I have to go to work.

Well thanks for the links and advise Brent.