Was my comp hacked?

Question

Hi,
i'm observing lately strange symptoms:
1. jabber client does not connect to servers (msn and icq are ok). I tried gaim mostly, centericq too.
2. firefox shows strange dialog about expired certificate on void.gr - i do not visit the site and the dialog shows up even when all extenstions are disabled.
3. nmap shows strange things (port 111 and 876 are open):
>sudo nmap -A -T4 localhost
Starting Nmap 4.20 ( http://insecure.org ) at 2007-02-17 21:46 IST
Interesting ports on wizard.localdomain (127.0.0.1):
Not shown: 1693 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 4.5 (protocol 2.0)
[b]111/tcp open rpcbind 2 (rpc #100000)
876/tcp open unknown
[/b]6000/tcp open X11 (access denied)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.18 - 2.6.19 (x86)
Uptime: 6.935 days (since Sat Feb 10 23:19:19 2007)
Network Distance: 0 hops
Service Info: OS: Unix
OS and Service detection performed. Please report any incorrect results at http://insecure.org/nmap/submit/ .
Nmap finished: 1 IP address (1 host up) scanned in 7.584 seconds
When i'm running nmap, there's no internet related application as far as i know. ssh is open for remote access, but (again, as far as i know, it's limited to one user with serious password).
Help, what's going on?????????

Answer 1

Well, i believe everything is ok, unless someone tells me differently . It looks like fam and portmap are opening these ports. I wonder why? Can anyone explain?
>sudo /etc/rc.d/fam stop
>sudo /etc/rc.d/portmap stop
>sudo nmap -A -T4 localhost
Starting Nmap 4.20 ( http://insecure.org ) at 2007-02-18 10:00 IST
Interesting ports on wizard.localdomain (127.0.0.1):
Not shown: 1695 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 4.5 (protocol 2.0)
6000/tcp open X11 (access denied)
No exact OS matches for host (If you know what OS is running on it, see http://insecure.org/nmap/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=4.20%D=2/18%OT=22%CT=1%CU=33931%PV=N%DS=0%G=Y%TM=45D807BF%P=i686-
OS:pc-linux-gnu)SEQ(SP=C1%GCD=1%ISR=CB%TI=Z%II=I%TS=8)SEQ(SP=C2%GCD=1%ISR=C
OS:B%TI=Z%II=I%TS=8)SEQ(SP=C1%GCD=1%ISR=CB%TI=Z%II=I%TS=8)OPS(O1=M400CST11N
OS:W5%O2=M400CST11NW5%O3=M400CNNT11NW5%O4=M400CST11NW5%O5=M400CST11NW5%O6=M
OS:400CST11)WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)ECN(R=Y%DF=
OS:Y%T=40%W=8018%O=M400CNNSNW5%CC=N%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%
OS:Q=)T2(R=N)T3(R=Y%DF=Y%T=40%W=8000%S=O%A=S+%F=AS%O=M400CST11NW5%RD=0%Q=)T
OS:4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+
OS:%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y
OS:%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%TOS=C0%IPL=164%UN=0%
OS:RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G)IE(R=Y%DFI=N%T=40%TOSI=S%CD=S%SI
OS:=S%DLI=S)
Uptime: 7.446 days (since Sat Feb 10 23:19:20 2007)
Network Distance: 0 hops
Service Info: OS: Unix
OS and Service detection performed. Please report any incorrect results at http://insecure.org/nmap/submit/ .
Nmap finished: 1 IP address (1 host up) scanned in 17.726 seconds
>sudo netstat -lp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 *:6000 *:* LISTEN 22409/X
tcp 0 0 *:ssh *:* LISTEN 10136/sshd
udp 108088 0 *:bootpc *:* 450/dhcpcd
raw 0 0 *:icmp *:* 7 22371/vmnet-natd
Active UNIX domain sockets (only servers)
Last edited by drakosha (2007-02-18 07:57:54)