I was Hacked. I also found a suspect file. Can anyone decipher it?

Question

I know I was hacked by my ex-partner (i was pretty much told so and that I was easy to track down (i.e. my computer) through it's IP address using an old email).
I also found a unknown file at the top level of my hard drive. I know everything that is at this directory level.
I opened the file using word and it contained the following:
DMFRAM -Error( 0): Can't open file: dt05tmp.01 !
(repeated 5 times)
Can anyone decipher this?
I am now really paranoid. I thought I was safe with Apple's built-in Firewall set to maximum security so learning this has caused me a lot of concern.
I have since purchased and installed NetBarrier and disabled the root user. Any other tips to secure my computer would be greatly appreciated.
15" Powerbook 1 GHz   Mac OS X (10.4.7)  
I also would like to check my logs to see if I can spot any unusual activity but i can only see the last three days in the ipfw.log? Can anyone tell me where to find older and/or the logs i should be looking at?
Thanks in advance

Answer 1

Having the firewall turned on is only useful against mitigating attacks that target services you don't want/expect to run. It does nothing against protecting against services that you enable. For example, if you're running a web server you presumably want to allow people to hit it, therefore the firewall needs to allow port 80 traffic in. It's not validating that traffic to see whether it's a real request, or whether the web server software you're running contains a vulnerability (like the all-too-common sql-injection common to many discussion boards).
Even more importantly the firewall doesn't do anything to protect against weak passwords. The chances are your friend knows your name (he is your friend after all), so he has half the keys he needs to get into your machine if you have SSH/Remote Login enabled. Now all he has to do is try different password combinations until one works... pet's name, child's name, zip code, etc. Once he finds a match there's no firewall in the world that's going to stop him poking around your machine, and this is the likeliest cause of any break-ins.
What can you do about it? not much other than to use really good passwords and to disable any accounts that you don't absolutely need.
As for the logs, they're rotated and compressed weekly where the last four weeks' logs are /var/log/ipfw.0.gz, /var/log/ipw.1.gz, etc.
You can use Console.app to view the logs, or decompress them manually at the command line. However, it's unlikely to yield any results if he came in through a door that was unlocked.
What might be more useful is the system.log or secure.log which will log failed login attempts. I'm betting somewhere there (maybe in one of the .gzipped versions) there's a number of password failures (unless your password is really easy to remember.