Recently an output of netstat -a gave an output of one established ftp connection. This is weird because I do not have any ftp software installed and never use it. I have no reason to.

The weirder part is that the connection persisted after closing down my internet connection. I could not kill the pid nor would it go away. I had to restart my system to get rid of it.

Whats up with that??? Sound fishy to anyone? Could this be evidence of SSH tunneling or similar? I feel confident I wiped out any malware I had but my network I am not in love with. I suspect there is something lurking someplace I cannot see but not 100% on that. My suspicion comes from, among other things, the fact that if ALL computers in the house are completely off and the router is rebooted as soon as it's back online its flashing like fucking mad with wireless internet connectivity. There is also a wireless connection always present, with no computers running. Weird?

Security- router has wpa2 with a fairly tough password, my mac i have locked down as best I can without TOO much effort. Root disabled all accounts have 8+ character passwords mixing numbers letters symbols etc, my firewall is set to deny all inbound connections and with little snitch i keep an eye on outbound. I mean what else can/should I be doing? If someone is breaking into my mac or using my network how can I find evidence of this? FWIW I tried packet capturing and was bewildered at the data I received. I have no clue what any of it means. I also have cocoa packet sniffer.