Debug help

Hello, I was looking at kernel log's and found some parts what was "interesting"

I previously started looking what has been going on in my computer because I had hacker attacks on my machine.

Installed Avira & Little Snitch - softwares

Previously my computer opened few folders what I have not opened my self so some script from internet obviously is installed at some point.

This does not mean "a lot" - mostly security threat of my computer (which does not contain any secret / harmful material at all) but still I keep wondering about few things and decided to post an comment to here to get some debugging help from more experienced people.

Thanks for your notice / interest.

2013-03-28 16:11:44.418 EET - opendirectoryd (build 172.17) launched...
2013-03-28 16:11:44.419 EET - Logging level limit changed to 'error'
2013-03-28 16:11:52.873 EET - Initialize trigger support
2013-03-28 16:11:52.874 EET - Registered node with name '/Active Directory' as hidden
2013-03-28 16:11:52.874 EET - Registered node with name '/Configure' as hidden
2013-03-28 16:11:52.875 EET - Discovered configuration for node name '/Contacts' at path '/Library/Preferences/OpenDirectory/Configurations//Contacts.plist'
2013-03-28 16:11:52.875 EET - Registered node with name '/Contacts'
2013-03-28 16:11:52.875 EET - Registered node with name '/LDAPv3' as hidden
2013-03-28 16:11:52.877 EET - Registered node with name '/Local' as hidden
2013-03-28 16:11:52.878 EET - Registered node with name '/NIS' as hidden
2013-03-28 16:11:52.879 EET - Discovered configuration for node name '/Search' at path '/Library/Preferences/OpenDirectory/Configurations//Search.plist'
2013-03-28 16:11:52.879 EET - Registered node with name '/Search'
2013-03-28 16:11:52.880 EET - Loaded bundle at path '/System/Library/OpenDirectory/Modules/legacy.bundle'
2013-03-28 16:11:52.882 EET - Loaded bundle at path '/System/Library/OpenDirectory/Modules/search.bundle'
2013-03-28 16:11:53.884 EET - '/Search' has registered, loading additional services
2013-03-28 16:11:53.884 EET - Initialize augmentation support
2013-03-28 16:11:53.887 EET - Loaded bundle at path '/System/Library/OpenDirectory/Modules/SystemCache.bundle'
2013-03-28 16:11:53.891 EET - Successfully registered for Kernel identity service requests
2013-03-28 16:11:53.896 EET - Loaded bundle at path '/System/Library/OpenDirectory/Modules/PlistFile.bundle'
2013-03-28 16:11:53.897 EET - Loaded bundle at path '/System/Library/OpenDirectory/Modules/FDESupport.bundle'
2013-03-28 16:11:53.910 EET - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ConfigurationProfiles.bundle'
2013-03-28 16:11:53.910 EET - Registered subnode with name '/Local/Default'
2013-03-28 16:12:10.289 EET - Loaded bundle at path '/System/Library/OpenDirectory/Modules/ldap.bundle'

UNIX has an interesting command that tells you the unique names of all executed executables and the count of executions since boot. Darned if I can recall what it is called.

You might look for files with odd permission for where they are, files with setuid or setgid, changes in the list, age, checksum of files owned by root and his priviledged buddies. You might want to run a proprietary checksum for that, hackers put in compensation dummy data for common checksums, maybe a personal md5.