A followup from myself: First, thanks for all the answers. To summarise:
neither lsof, nor netstat or fuser gave a sign that any program on my server listens on that port. I have aide running on this machine so i am quite sure that the the programs are intact. >From what Kristof Goossens and Nikolay Hristov say, i guess there is a firewall at the provider, that is blocking the port, which seems to be used by arcserve. As for "Why so many open ports?", well, i turned the firewall off for scanning :-) I am now quite shure that there was no breakin, but will follow the suggestion by Jean-Francois Dive an let a sniffer run... Thanks again, Ramin
