Why is port 1111 open, and is it safe to be?

According to this reference:

Because protocol TCP port 1111 was flagged as a virus (colored red) does not mean that a virus is using port 1111, but that a Trojan or Virus has used this port in the past to communicate.

So, it could be a virus/trojan.

I would recommend you to use Net Activity Viewer to determine what process/service is keeping this port on listening state:

After this, Google the process name to see if there are any viruses related to this process and to this port.

Finally, if you think it is a virus, just follow the instructions guided here.

You can use lsof -i :1111 to find the process connected to port 1111.

IANA's (Internet Assigned Numbers Authority) port description is:

1111 tcp,udp lmsocialserver LM Social Server

But its also known to be used by

1111    tcp trojan  Daodan, Ultors Trojan   Trojans
1111    udp trojan  Daodan  Trojans
1111    tcp threat  W32.Suclove Bekkoame
1111    tcp,udp threat  AIMVision   Bekkoame

Trojans that use this port:
    Backdoor.AIMvision - remote access trojan, 10.2002. Affects all current Windows versions.
    Backdoor.Ultor - remote access trojan, 06.2002. Affects Windows, listens on port 1111 or 1234.
    Backdoor.Daodan - VB6 remote access trojan, 07.2000. Affects Windows.
    W32.Suclove.A@mm (09.26.2005) - a mass-mailing worm with backdoor capabilities that spreads through MS Outlook and MIRC. Opens a backdoor and listens for remote commands on port 1111/tcp.

Sources:

http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

http://www.speedguide.net/port.php?port=1111