Help, please! I've Been Hacked! Firewall & Admin permissions changed?

Question

Running on 10.4
MacBook Pro
You guys have been great, and I tried to read as many threads as I could to solve the problem on my own, but I'm in way too over my head. Okay, I'm going to struggle through explaining this as best I can and just list the "highlights" of what has been going on. More details are below.
Several events occurred simultaneously, and I'm not sure which did what damage.
Scanned my machine with ClamXav. Trojan was found. I deleted the Trojan.
I downloaded a script (against my better judgement), opened it and my machine started working hard. Activity monitor was going crazy. Immediately shut down Airport. Looked at my Firewall, and EVERYTHING was open. I always keep Firewall on. Looked at logs (and saved a few). Good thing I did because for some reason, I now do not have permission to view sa or security logs. Awesome.
Here is a more detailed account of what happened. I know it's long, but I'm trying to answer any questions you guys might have.
Two nights ago, I scanned my machine using Clam. It was the first time I had run the scan, and it found a Trojan in the form of an mp3. I located the file in Finder so that I would know where it was located to delete it, clicked on info, and iTunes opened, which I had not planned on because I had only selected info. I immediately force quit iTunes and deleted the file. I was never prompted for my password, so *was the virus executed*? I have since run Clam several times, and there are no infected files.
Next thing: I downloaded a script which I'm 99% sure was malicious. I'm not a techie, and I know this was incredibly stupid given my lack of knowledge. After opening it, I saw that it was all in a different language (Portuguese, I think?), and immediately closed and deleted. Then my machine started running hard... I checked activity monitor, and things were going crazy. I immediately disconnected from Airport. I don't remember exactly what the numbers were, but there were a lot of page ins/page outs and data being read/written. (I don't even know what those mean exactly, but I check Activity Monitor fairly frequently to look at memory and see what programs are taking up space.) But I was also doing a scan with Clam and I had about 14 tabs open in Safari, so I'm not certain if the activity was correlated to the scan or to the script or to having so many things open and going at once.
I checked my firewall, and it was off. I hadn't looked at it in a few months, but I'm fairly certain I had it activated. Remote access, FTP, etc. - basically all sharing options were enabled. I disabled everything and started the Firewall. I looked at the logs (even though I don't really know how to read them) and saved several of them which I would be glad to post here. One I saved was the Secure Log - I tried to look at any new activity today, and I got the message "You do not have permission to read this log file". What's strange is that my Firewall has logs dated for preceding days and months... but the Firewall was not activated when I initially checked it.?? That doesn't make a lot of sense to me.
I created a Master Password (alphanumeric 17 characters) in File Vault, but I did not turn on Fire Vault... I'm not sure if this changed any settings and has to do with why I can't read certain log files.? To my knowledge, I'm still the admin.? How do I tell if that has been changed? I ran Disk Utility, and it changed a few permissions, fwiw, but I still don't have access to particular logs.
I have Little Snitch running, and it hasn't shown anything abnormal. I looked at my DNS, and it's the same as what it always has been. I'll be glad to post the logs I have, but I don't know what's pertinent and what isn't. Here's a Big Problem: I don't have my installation disk. I know I will probably be advised to wipe everything and reload, but the disk is 500+ miles away tucked in a storage facility. This is killing me. I've been reading everything I can on this forum (you guys are awesome, btw), and was going to try to muddle through this on my own, but I'm way over my head. How can I reinstall if I don't have the installation disks? Or maybe I'm being paranoid and someone didn't get in to my system? Any help would be appreciated.

Answer 1

If this helps, this is my Firewall plist. The plist was created on the day and around the time of all this happening. If everything is enabled to be editable, does that mean that they could have rewritten the codes after I locked everything down?
<plist version="1.0">
<dict>
<key>allports</key>
<array/>
<key>alludpports</key>
<array/>
<key>firewall</key>
<dict>
<key>Apple Remote Desktop</key>
<dict>
<key>editable</key>
<integer>0</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>3283</string>
<string>5900</string>
</array>
<key>row</key>
<integer>5</integer>
<key>udpport</key>
<array>
<string>3283</string>
<string>5900</string>
</array>
</dict>
<key>FTP Access</key>
<dict>
<key>editable</key>
<integer>0</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>21</string>
</array>
<key>row</key>
<integer>4</integer>
</dict>
<key>Network Time</key>
<dict>
<key>editable</key>
<integer>1</integer>
<key>enable</key>
<integer>0</integer>
<key>row</key>
<integer>11</integer>
<key>udpport</key>
<array>
<string>123</string>
</array>
</dict>
<key>Personal File Sharing</key>
<dict>
<key>editable</key>
<integer>0</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>548</string>
<string>427</string>
</array>
<key>row</key>
<integer>0</integer>
</dict>
<key>Personal Web Sharing</key>
<dict>
<key>editable</key>
<integer>0</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>80</string>
<string>427</string>
<string>443</string>
</array>
<key>row</key>
<integer>2</integer>
</dict>
<key>Printer Sharing</key>
<dict>
<key>editable</key>
<integer>0</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>631</string>
<string>515</string>
</array>
<key>row</key>
<integer>7</integer>
</dict>
<key>Remote Apple Events</key>
<dict>
<key>editable</key>
<integer>0</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>3031</string>
</array>
<key>row</key>
<integer>6</integer>
</dict>
<key>Remote Login - SSH</key>
<dict>
<key>editable</key>
<integer>0</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>22</string>
</array>
<key>row</key>
<integer>3</integer>
</dict>
<key>Samba Sharing</key>
<dict>
<key>editable</key>
<integer>0</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>139</string>
</array>
<key>row</key>
<integer>1</integer>
<key>udpport</key>
<array>
<string>137</string>
<string>138</string>
</array>
</dict>
<key>iChat Rendezvous</key>
<dict>
<key>editable</key>
<integer>1</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>5297</string>
<string>5298</string>
</array>
<key>row</key>
<integer>8</integer>
</dict>
<key>iPhoto Rendezvous Sharing</key>
<dict>
<key>editable</key>
<integer>1</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>8770</string>
</array>
<key>row</key>
<integer>10</integer>
</dict>
<key>iTunes Music Sharing</key>
<dict>
<key>editable</key>
<integer>1</integer>
<key>enable</key>
<integer>0</integer>
<key>port</key>
<array>
<string>3689</string>
</array>
<key>row</key>
<integer>9</integer>
</dict>
</dict>
<key>loggingenabled</key>
<integer>1</integer>
<key>state</key>
<true/>
<key>stealthenabled</key>
<integer>1</integer>
<key>udpenabled</key>
<integer>1</integer>
</dict>
</plist>