RE: [cobalt-users] last bit of hacker droppings.

["Tony" <isplists@xxxxxxxxxxxx>]

+> Resolved that, thanks. Killed the bogus init and restored the other bogus
+> system files.
+> Just installed logcheck and netstat shows these ports which I didn't see
+> before:
+> udp        0      0 0.0.0.0:7938            0.0.0.0:*
+> raw        0      0 0.0.0.0:1               0.0.0.0:*               7
+> raw        0      0 0.0.0.0:6               0.0.0.0:*               7
+> Any idea what ports these are?
+
+
+The two raw port are normal, put the udp at port 7938 isn't, do a 
+netstat -nuap
+to see which process is controlling it and investigate that process.
+
+Jeff-


7937 and 7938 are Knox Arkeia ports. I actually noticed these before the 
hack and forgot about them. Why does the Raq3 load and run these if Arkeia
is not GUI-enabled? How do you shut them down?