DiGuru said:
Did you ever check the log of a router, say two hours after the connection went live? What do you see?
Well, I can take my linux box's shorewall logs, since I don't have a router. 99.99% is inept script-kiddie shit, mostly simple FTP password stabs and various IIS attacks.
Only once I've had to clean up a computer that had been comprimised from the outside, and that was 6-7 years ago on a Win98 box without a firewall. However, I have cleaned out plenty that was compromised by trojans(which a NAT router does squat-all about).