Impressed: it has been years since I've been hacked this well :(

[Brent Anderson]

Hello.

I'm surprised no one has mentioned disconnecting your computer from  
the internet. If you happen to have a ghost, then chances very good  
are he won't be able to do anything if you unplug from the internet.  
 From there, close down all applications running, crack open activity  
monitor, and anything that you don't recognize should be investigated  
and probably switched off.

General security practice on the Mac - Make sure your firewall is on,  
unless you are using a port keep it closed. UDP Blocking/Firewall  
Logging/Stealth Mode should be on too. The most important thing is  
that you don't visit anything questionable and that you know where  
your internet is coming from.

If your ghost has any Mac sense at all and if your problem is  
recurring when you boot up, crack open a terminal and take a look at  
the file in /etc/crontab. Download Lingon from Peter Borg to  
investigate what Launchd processes are running. If you have anything  
that looks like it shouldn't belong, it probably doesn't.

There's more, but I have to go to work.

Thanks,
Brent Anderson