I think I've been hacked!

[fuoms]

A few days ago, after booting my computer, open office writer launched itself. This has been happening evry time I boot up. I checked my startup programs in Sessions but there was no mention of any office program. Today, office did not come up but instead a terminal window popped up upon booting. This seems very strange to me.

Went to https://www.grc.com/ to do some general security tests and everything seems fine. These are the results:
----------------------------------------------------------------------
GRC Port Authority Report created on UTC: 2008-04-14 at 20:31:24
Results from scan of ports: 0, 21-23, 25, 79, 80, 110, 113,
119, 135, 139, 143, 389, 443, 445,
1002, 1024-1030, 1720, 5000
0 Ports Open
0 Ports Closed
26 Ports Stealth
---------------------
26 Ports Tested
ALL PORTS tested were found to be: STEALTH.
TruStealth: PASSED - ALL tested ports were STEALTH,
- NO unsolicited packets were received,
- NO Ping reply (ICMP Echo) was received.
-----------------------------------------------------------------------

How could this be happening. Which files can I check to see which programs start upon booting? Are there any log files that would keep a list of who logged in?

I am behind a router, and using Fedora's firewall. There are no trusted services, firewall is enabled, no ports specified as trusted, no custom rules, and SElinux is set to Enforcing.
Have I been hacked or is there a logical explaiation?

I am using Fedora 7: uname -r
2.6.23.15-80.fc7

[glennzo]

Look in System > Preferences > Personal > Sessions. The right tab has a check box to Automatically remember running applications when logging out. If that's checked and you routinely log out without closing apps they will start when you log in.

[gthill]

Originally Posted by fuoms

How could this be happening. Which files can I check to see which programs start upon booting? Are there any log files that would keep a list of who logged in?

from the command line
#last
will give you a list of all those who have logged in and when.

[fuoms]

Thanks for the quick response guys.
The check box to Automatically save changes to session in not ticked, BUT I remember looking through sessions to see if I could see Open office and I remember pressing save session (the button under the check box). Tried it again with Evolution started and low and behold evolution starts when booting. I must have pressed it a few days ago too.
Ohh well, I changed my passwords just in case. I should never have doubted Linux and Fedora.......Sorry!
Thanks again!

[stevea]

You have absolutely no evidence of a hack. You probably don't need 26 stealth ports, but it doesn't imply a hack. It's pretty common for a noob to click the wrong box or to save sessoins as glennzo noted.

My hunch is that your paranoid ! I used to work with a guy who thought that every time something unexpected happened on his computer it was a hacker or malware. It was pretty amusing to listen to him rant about the prevalence of hackers and malware.

Take two beers, check out the "save session on exit" marks and post again in the morning.

[fuoms]

Hi steva
Maybe I didn't make myself clear. I am pretty certain that pressing the save session caused the problem, as I mentioned in my previous reply 5 mins before your post.
Thanks again to all, for taking the time to respond.