hacked machine ?

["Matus \"fantomas\" Uhlar" <uhlar@fantomas.sk>]

HEllo,
just yesterday I was logged to my debian machine from Sun solaris 2.5.1
machine using ssh;

when I closed session i saw message like "waiting for closing of forwarded
X11 sessions from <IP>"

I checked netstat on solaris - no connection from that IP;

I checked netstat on debian machine and there were few connectrions opened:
one to port 6000; one to finger port, one to ident port, one to portmap port
and one to poppassd port;

I saw also processes cfingerd, identd, portmap, poppassd and X;
in X i had xearth, xterm and netscape opened;

It seems someone hacked my machine; anyway i disabled all connections from
that IP and killed those processes; can anyone tell me where can be the
problem ?

-- 
 Matus "fantomas" Uhlar, sysadmin at NETLAB+ Kosice, Slovakia
 BIC coord for *.sk; admin of netlab.irc.sk; co-admin of irc.felk.cvut.cz