Mac Hacked

[kerowo]

So last night I wake up in the wee hours to, well, wee and notice lights coming from my Mac. I go over to see what's up and see some Explorer windows open and the cursor moving around.

Well, that sucks.

So instead of unplugging the network cable so I can see what is up I end up just shutting the thing off. This morning I'm looking at and best I can tell he was on for about a half hour or so. I used Explorer a couple of times last year for some sites that didn't work with Safari and am going to just uninstall it. I think he used it because my Safari window was on my second monitor and when I VNC into my box I only have access to one monitor.

So looking at the history window he went to paltalk and was trying to get into checkfree. There was also a Yahoo Messenger window open but not logged in, probably because I haven't used that for a while and the password doesn't work anymore.

So what should I be looking for now? I could have swore I had shut down the VNC server and it has a password on it so I'm really not sure how he got in. I turned off the DSL modem for a while and refreshed my IP address. I've looked through the logs and don't see anything weird and looked in Applications and Documents for newly created files and don't see anything and will do a Spotlight search for newly created files and see if there is anything weird.

When I was first getting VNC set up there was probably a window where I had the port open to the world and the password not set which is all I can think of how he got in. I'll change the password on the VNC server and probably look for another one. Anything else I should be looking for?