For the past week or so I noticed an empty window which pops up seemingly
at random on my screen. It looks like a terminal....but with no cursor
inside. The only way it can be closed is by using xkill. I use IceWm and
unless I kill it before logging out I can't log out!

I'd appreciate any tips on tracking this thing down.

Frank

---


Change the world one loan at a time - visit Kiva.org to find out how







--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

> * From: Frank <debian@videotron.ca>
>For the past week or so I noticed an empty window which pops up

try htop or pstree or many other similar tools


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 16:57:08 +0200
NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:

> > * From: Frank <debian@videotron.ca>
> >For the past week or so I noticed an empty window which pops up
>
> try htop or pstree or many other similar tools


As far as I can see neither show anything unususal, How can I find out
what process owns the window ?



- --

Change the world one loan at a time - visit Kiva.org to find out how





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIDgZinQV1aTcQlJsRArhvAJ4nZpafAwxAI0dgcCadDz jTwdwyeQCfVfGD
Vnq0T1YkZqymABF/2dFACn4=
=NnEx
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Tue, Apr 22, 2008 at 11:38:06AM -0400, Frank McCormick wrote:
> On Tue, 22 Apr 2008 16:57:08 +0200
> NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:
> > > * From: Frank <debian@videotron.ca>
> > >For the past week or so I noticed an empty window which pops up
> > try htop or pstree or many other similar tools
> As far as I can see neither show anything unususal,

If *really* you can identify all processes as shown by, say, htop in
tree mode run by root, and you are sure than none of them gives the
unusual window, then either your box has been hacked or you have found a
big bug (in htop or the kernel), or the process is really run by another
host and only connects to your X server (but then you should see the
connection with netstat, either directly as tcp connection, or as a tcp
ssh connection plus a unix socket). Also note that the xkill man page
suggests at the end xwininfo

So I would double ckeck. Closing all not indispensable processes might
, as also using tree mode (the window should be in the tree of
processes after the Xserver process, and the parent processes might give
an idea of which process spawned the window process. Unless the window
has been orphaned)

--
Chi usa software non libero avvelena anche te. Digli di smettere.
Informatica=arsenico: minime dosi in rari casi patologici, altrimenti letale.
Informatica=bomba: intelligente solo per gli stupidi che ci credono.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 20:35:45 +0200
NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:

> On Tue, Apr 22, 2008 at 11:38:06AM -0400, Frank McCormick wrote:
> > On Tue, 22 Apr 2008 16:57:08 +0200
> > NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:
> > > > * From: Frank <debian@videotron.ca>
> > > >For the past week or so I noticed an empty window which pops up
> > > try htop or pstree or many other similar tools
> > As far as I can see neither show anything unususal,
>
> If *really* you can identify all processes as shown by, say, htop in
> tree mode run by root, and you are sure than none of them gives the
> unusual window, then either your box has been hacked or you have found a
> big bug (in htop or the kernel), or the process is really run by another
> host and only connects to your X server (but then you should see the
> connection with netstat, either directly as tcp connection, or as a tcp
> ssh connection plus a unix socket). Also note that the xkill man page
> suggests at the end xwininfo

I will have to wait now until I get the window back - I killed it and
rebooted earlier. I'm not sure what creates it so I'll have to wait.

But all your suggestions seem to be good ones



- --

Change the world one loan at a time - visit Kiva.org to find out how





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIDm0fnQV1aTcQlJsRAotTAJ476wTBD79mzeDHqKtabY oW3Yg9iACgkoEF
Ga++LWyCaRxoZjAXpruMNdA=
=nitO
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Frank wrote:
> For the past week or so I noticed an empty window which pops up seemingly
> at random on my screen. It looks like a terminal....but with no cursor
> inside. The only way it can be closed is by using xkill. I use IceWm and
> unless I kill it before logging out I can't log out!
>
> I'd appreciate any tips on tracking this thing down.
>
> Frank
>
> ---
>
>
> Change the world one loan at a time - visit Kiva.org to find out how
>
>
>
>
>
>
>
>
There is an xapp that you can run, then click on a screen (or x-app) and
it will tell you the source of the app. That is the good news, the bad
news is I can't remember what it is: perhaps xtrace?

--
Damon L. Chesser
damon@damtek.com
http://www.linkedin.com/in/dchesser



--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 19:06:04 -0400
"Damon L. Chesser" <damon@damtek.com> wrote:

> Frank wrote:
> > For the past week or so I noticed an empty window which pops up
> > seemingly at random on my screen. It looks like a terminal....but with
> > no cursor inside. The only way it can be closed is by using xkill. I
> > use IceWm and unless I kill it before logging out I can't log out!
> >
> There is an xapp that you can run, then click on a screen (or x-app) and
> it will tell you the source of the app. That is the good news, the bad
> news is I can't remember what it is: perhaps xtrace?

I think it's xwininfo you're thinking about - I'm waiting for this
mysterious window to re-appear. Too bad I don't know how to make it happen!


Thanks

- --

Change the world one loan at a time - visit Kiva.org to find out how





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIDoLanQV1aTcQlJsRAti3AJ9z+Y7jXluhoLffpDfqV9 XXjjZJHACePrC0
bU7mSuNTvDoR2ynQPhpCw2w=
=8R9A
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Frank McCormick wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Tue, 22 Apr 2008 19:06:04 -0400
> "Damon L. Chesser" <damon@damtek.com> wrote:
>
>
>> Frank wrote:
>>
>>> For the past week or so I noticed an empty window which pops up
>>> seemingly at random on my screen. It looks like a terminal....but with
>>> no cursor inside. The only way it can be closed is by using xkill. I
>>> use IceWm and unless I kill it before logging out I can't log out!
>>>
>>>
>> There is an xapp that you can run, then click on a screen (or x-app) and
>> it will tell you the source of the app. That is the good news, the bad
>> news is I can't remember what it is: perhaps xtrace?
>>
>
> I think it's xwininfo you're thinking about - I'm waiting for this
> mysterious window to re-appear. Too bad I don't know how to make it happen!
>
>
> Thanks
>
> - --
>
> Change the world one loan at a time - visit Kiva.org to find out how
>
>
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iD8DBQFIDoLanQV1aTcQlJsRAti3AJ9z+Y7jXluhoLffpDfqV9 XXjjZJHACePrC0
> bU7mSuNTvDoR2ynQPhpCw2w=
> =8R9A
> -----END PGP SIGNATURE-----
>
>
>
Yup, that is the name. Checked, I have it, tried it, it works.

--
Damon L. Chesser
damon@damtek.com
http://www.linkedin.com/in/dchesser


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 18:56:26 -0400
Frank McCormick <debian@videotron.ca> wrote:

> > > > >For the past week or so I noticed an empty window which pops up
> > > > try htop or pstree or many other similar tools
> > > As far as I can see neither show anything unususal,
> >
> > If *really* you can identify all processes as shown by, say, htop in
> > tree mode run by root, and you are sure than none of them gives the
> > unusual window, then either your box has been hacked or you have found
> > a big bug (in htop or the kernel), or the process is really run by
> > another host and only connects to your X server (but then you should
> > see the connection with netstat, either directly as tcp connection, or
> > as a tcp ssh connection plus a unix socket). Also note that the xkill
> > man page suggests at the end xwininfo
>
> I will have to wait now until I get the window back - I killed it and
> rebooted earlier. I'm not sure what creates it so I'll have to wait.

Got the weird window back tonight - it may have something to do with (I
think) my Sylpheed mail reader. At least that's what I was using when I
noticed it.

frank@debian:~$ xwininfo

xwininfo: Please select the window about which you
would like information by clicking the
mouse in that window.

xwininfo: Window id: 0xc00008 (has no name)
^^^^^^^^^^^^ first time I've seen this!!

Absolute upper-left X: 82
Absolute upper-left Y: 127
Relative upper-left X: 0
Relative upper-left Y: 0
Width: 185
Height: 175
Depth: 24
Visual Class: TrueColor
Border width: 0
Class: InputOutput
Colormap: 0x20 (installed)
Bit Gravity State: ForgetGravity
Window Gravity State: NorthWestGravity
Backing Store State: NotUseful
Save Under State: no
Map State: IsViewable
Override Redirect State: no
Corners: +82+127 -1413+127 -1413-748 +82-748
-geometry 185x175+82+127


This is after I enlarged it - when it first appears its very small so I
guess it often goes unnoticed.

It's got me baffled...but that's not very hard!

BTW I am running Sid/Lenny


- --
Frank McCormick debian@videotron.ca
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIESe7nQV1aTcQlJsRAsIDAKCSPU4I6Fh87n6rOrnBOA e2OVBRkgCaA4Ry
PrAQ7fjVTIGbv4XmpaVTepQ=
=AwzK
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 18:56:26 -0400
Frank McCormick <debian@videotron.ca> wrote:

> > > > >For the past week or so I noticed an empty window which pops up
> > > > try htop or pstree or many other similar tools
> > > As far as I can see neither show anything unususal,
> >
> > If *really* you can identify all processes as shown by, say, htop in
> > tree mode run by root, and you are sure than none of them gives the
> > unusual window, then either your box has been hacked or you have found
> > a big bug (in htop or the kernel), or the process is really run by
> > another host and only connects to your X server (but then you should
> > see the connection with netstat, either directly as tcp connection, or
> > as a tcp ssh connection plus a unix socket). Also note that the xkill
> > man page suggests at the end xwininfo
>
> I will have to wait now until I get the window back - I killed it and
> rebooted earlier. I'm not sure what creates it so I'll have to wait.

Got the weird window back tonight - it may have something to do with (I
think) my Sylpheed mail reader. At least that's what I was using when I
noticed it.

frank@debian:~$ xwininfo

xwininfo: Please select the window about which you
would like information by clicking the
mouse in that window.

xwininfo: Window id: 0xc00008 (has no name)
^^^^^^^^^^^^ first time I've seen this!!

Absolute upper-left X: 82
Absolute upper-left Y: 127
Relative upper-left X: 0
Relative upper-left Y: 0
Width: 185
Height: 175
Depth: 24
Visual Class: TrueColor
Border width: 0
Class: InputOutput
Colormap: 0x20 (installed)
Bit Gravity State: ForgetGravity
Window Gravity State: NorthWestGravity
Backing Store State: NotUseful
Save Under State: no
Map State: IsViewable
Override Redirect State: no
Corners: +82+127 -1413+127 -1413-748 +82-748
-geometry 185x175+82+127


This is after I enlarged it - when it first appears its very small so I
guess it often goes unnoticed.

It's got me baffled...but that's not very hard!

BTW I am running Sid/Lenny


- -
- --

Change the world one loan at a time - visit Kiva.org to find out how





- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIESe7nQV1aTcQlJsRAsIDAKCSPU4I6Fh87n6rOrnBOA e2OVBRkgCaA4Ry
PrAQ7fjVTIGbv4XmpaVTepQ=
=AwzK
- -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD4DBQFIEStdnQV1aTcQlJsRAoRJAJwLok/gAxFBvxzBIM+BAPyKT7hMrwCXcpzu
30PXDLmQySTYAyb8/dVXDA==
=VTSd
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Tue, Apr 22, 2008 at 10:30:59AM -0400, Frank wrote:
>
>
> For the past week or so I noticed an empty window which pops up seemingly
> at random on my screen. It looks like a terminal....but with no cursor
> inside. The only way it can be closed is by using xkill. I use IceWm and
> unless I kill it before logging out I can't log out!
>
> I'd appreciate any tips on tracking this thing down.

What do you see on 'ps fax'?

--
Tzafrir Cohen | tzafrir@jabber.org | VIM is
http://tzafrir.org.il | | a Mutt's
tzafrir@cohens.org.il | | best
ICQ# 16849754 | | friend


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 25 Apr 2008 14:57:28 +0000
Tzafrir Cohen <tzafrir@cohens.org.il> wrote:

> On Tue, Apr 22, 2008 at 10:30:59AM -0400, Frank wrote:
> >
> >
> > For the past week or so I noticed an empty window which pops up
> > seemingly at random on my screen. It looks like a terminal....but with
> > no cursor inside. The only way it can be closed is by using xkill. I
> > use IceWm and unless I kill it before logging out I can't log out!
>
> What do you see on 'ps fax'?


Soon as the window pops up again, I'll post the output! These
suggestions keep coming AFTER I have killed it.

Thanks



- --
Frank debian@videotron.ca
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIEfqSnQV1aTcQlJsRAqcdAJ45Ai71JZNpD+GpyDAY3Y mKRoUvjACfS82e
R2APhHe479C+w/WOFra4144=
=lyX8
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 25 Apr 2008 14:57:28 +0000
Tzafrir Cohen <tzafrir@cohens.org.il> wrote:

> On Tue, Apr 22, 2008 at 10:30:59AM -0400, Frank wrote:
> >
> >
> > For the past week or so I noticed an empty window which pops up
> > seemingly at random on my screen. It looks like a terminal....but with
> > no cursor inside. The only way it can be closed is by using xkill. I
> > use IceWm and unless I kill it before logging out I can't log out!
> >
> > I'd appreciate any tips on tracking this thing down.
>
> What do you see on 'ps fax'?

frank@debian:~$ sudo ps fax
PID TTY STAT TIME COMMAND
2 ? S< 0:00 [kthreadd]
3 ? S< 0:00 \_ [migration/0]
4 ? S< 0:00 \_ [ksoftirqd/0]
5 ? S< 0:00 \_ [watchdog/0]
6 ? S< 0:00 \_ [migration/1]
7 ? S< 0:00 \_ [ksoftirqd/1]
8 ? S< 0:00 \_ [watchdog/1]
9 ? S< 0:00 \_ [events/0]
10 ? S< 0:01 \_ [events/1]
11 ? S< 0:00 \_ [ker]
43 ? S< 0:00 \_ [kblockd/0]
44 ? S< 0:00 \_ [kblockd/1]
47 ? S< 0:00 \_ [kacpid]
48 ? S< 0:00 \_ [kacpi_notify]
123 ? S< 0:00 \_ [kseriod]
157 ? S< 0:00 \_ [kswapd0]
158 ? S< 0:00 \_ [aio/0]
159 ? S< 0:00 \_ [aio/1]
507 ? S< 0:00 \_ [ksuspend_usbd]
535 ? S< 0:00 \_ [khubd]
706 ? S< 0:00 \_ [ata/0]
707 ? S< 0:00 \_ [ata/1]
708 ? S< 0:00 \_ [ata_aux]
735 ? S< 0:00 \_ [scsi_eh_0]
736 ? S< 0:00 \_ [usb-storage]
766 ? S< 0:00 \_ [scsi_eh_1]
769 ? S< 0:00 \_ [scsi_eh_2]
861 ? D< 0:01 \_ [kjournald]
1442 ? S< 0:00 \_ [kpsmoused]
1776 ? S< 0:00 \_ [ksnapd]
1807 ? S< 0:00 \_ [kjournald]
3545 ? S 0:00 \_ [pdflush]
4273 ? S 0:00 \_ [pdflush]
1 ? Ss 0:01 init [2]
939 ? S<s 0:00 udevd --daemon
1900 ? Ss 0:00 dhclient3 -pf /var/run/dhclient.eth0.pid -lf /var/lib/dhcp3/dhclient.eth0.leases eth0
2094 ? Ds 0:00 /sbin/syslogd
2101 ? Ss 0:00 /sbin/klogd -x
2112 ? Ss 0:00 /usr/bin/dbus-daemon --system
2387 ? Ss 0:00 /usr/sbin/gpm -m /dev/input/mice -t exps2
2396 ? S 0:00 /usr/sbin/smartd --pidfile /var/run/smartd.pid
2407 ? Ss 0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 103:105 -g
2420 ? Ss 0:00 /usr/sbin/hald
2421 ? S 0:00 \_ hald-runner
2441 ? S 0:00 \_ hald-addon-input: Listening on /dev/input/event3 /dev/input/event2 /dev/input/event0
2449 ? S 0:00 \_ hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event
2460 ? S 0:01 \_ hald-addon-storage: polling /dev/hdc (every 2 sec)
2462 ? S 0:02 \_ hald-addon-storage: polling /dev/hdd (every 2 sec)
2464 ? S 0:01 \_ hald-addon-storage: polling /dev/sda (every 2 sec)
2475 ? Ss 0:00 /usr/sbin/gdm
2480 ? S 0:00 \_ /usr/sbin/gdm
2486 tty7 Ss+ 12:54 \_ /usr/bin/X :0 -audit 0 -auth /var/lib/gdm/:0.Xauth -nolisten tcp vt7
2623 ? Ss 0:00 \_ /usr/bin/icewm-session
2672 ? SNs 0:00 \_ icewmbg
2673 ? Ss 4:16 \_ icewm --restart
2674 ? Ss 0:00 \_ icewmtray
2510 ? Ss 0:00 /usr/sbin/cron
2566 tty1 Ss+ 0:00 /sbin/getty 38400 tty1
2567 tty2 Ss+ 0:00 /sbin/getty 38400 tty2
2570 tty3 Ss+ 0:00 /sbin/getty 38400 tty3
2571 tty4 Ss+ 0:00 /sbin/getty 38400 tty4
2572 tty5 Ss+ 0:00 /sbin/getty 38400 tty5
2573 tty6 Ss+ 0:00 /sbin/getty 38400 tty6
2621 ? S 0:00 /usr/bin/gnome-keyring-daemon -d --login
2670 ? S 0:00 /usr/bin/dbus-launch --exit-with-session /usr/bin/icewm-session
2671 ? Ss 0:00 /usr/bin/dbus-daemon --fork --print-pid 6 --print-address 9 --session
2677 ? S 2:52 gkrellm
2678 ? S 0:24 /usr/bin/rox -p=default
10665 ? S 0:00 \_ /usr/bin/rxvt-xpm -geometry 120x60 -fn 8x16 -sb
10666 pts/0 Ss 0:00 \_ bash
10683 pts/0 R+ 0:00 \_ ps fax
frank@debian:~$

That's it - I don't see anything strange in there.


Cheers

Frank

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIEmkbnQV1aTcQlJsRAkqcAJ0eOopqfHuT+8NE3mWVt4 Vpei80UQCgkmAy
3e5224AE8MBej9YE5BjZOGA=
=E0WU
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Frank McCormick <fmccormick@videotron.ca>:
> On Fri, 25 Apr 2008 14:57:28 +0000
> Tzafrir Cohen <tzafrir@cohens.org.il> wrote:
> > On Tue, Apr 22, 2008 at 10:30:59AM -0400, Frank wrote:
> > >
> > > For the past week or so I noticed an empty window which pops up
> > > seemingly at random on my screen. It looks like a terminal....but with
> > > no cursor inside. The only way it can be closed is by using xkill. I
> > > use IceWm and unless I kill it before logging out I can't log out!

Just suggestions, not answers, sorry. :-(

xwininfo (in xbase-clients).

I don't know icewm, but what's in icewmtray? I don't know rox either,
but could it be syncing with a online db or something?

I've never heard of [aio].

I notice hald is probing each usb device every two seconds. I've no
idea whether that's normal. Others can , please? I'm on etch
with no hald.

I see nothing obviously wrong here either, aside from the stuff of
which I'm ignorant.

> > > I'd appreciate any tips on tracking this thing down.
> >
> > What do you see on 'ps fax'?
>
> frank@debian:~$ sudo ps fax
> PID TTY STAT TIME COMMAND
> 2 ? S< 0:00 [kthreadd]
> 3 ? S< 0:00 \_ [migration/0]
> 4 ? S< 0:00 \_ [ksoftirqd/0]
> 5 ? S< 0:00 \_ [watchdog/0]
> 6 ? S< 0:00 \_ [migration/1]
> 7 ? S< 0:00 \_ [ksoftirqd/1]
> 8 ? S< 0:00 \_ [watchdog/1]
> 9 ? S< 0:00 \_ [events/0]
> 10 ? S< 0:01 \_ [events/1]
> 11 ? S< 0:00 \_ [ker]
> 43 ? S< 0:00 \_ [kblockd/0]
> 44 ? S< 0:00 \_ [kblockd/1]
> 47 ? S< 0:00 \_ [kacpid]
> 48 ? S< 0:00 \_ [kacpi_notify]
> 123 ? S< 0:00 \_ [kseriod]
> 157 ? S< 0:00 \_ [kswapd0]
> 158 ? S< 0:00 \_ [aio/0]
> 159 ? S< 0:00 \_ [aio/1]
> 507 ? S< 0:00 \_ [ksuspend_usbd]
> 535 ? S< 0:00 \_ [khubd]
> 706 ? S< 0:00 \_ [ata/0]
> 707 ? S< 0:00 \_ [ata/1]
> 708 ? S< 0:00 \_ [ata_aux]
> 735 ? S< 0:00 \_ [scsi_eh_0]
> 736 ? S< 0:00 \_ [usb-storage]
> 766 ? S< 0:00 \_ [scsi_eh_1]
> 769 ? S< 0:00 \_ [scsi_eh_2]
> 861 ? D< 0:01 \_ [kjournald]
> 1442 ? S< 0:00 \_ [kpsmoused]
> 1776 ? S< 0:00 \_ [ksnapd]
> 1807 ? S< 0:00 \_ [kjournald]
> 3545 ? S 0:00 \_ [pdflush]
> 4273 ? S 0:00 \_ [pdflush]
> 1 ? Ss 0:01 init [2]
> 939 ? S<s 0:00 udevd --daemon
> 1900 ? Ss 0:00 dhclient3 -pf /var/run/dhclient.eth0.pid -lf /var/lib/dhcp3/dhclient.eth0.leases eth0
> 2094 ? Ds 0:00 /sbin/syslogd
> 2101 ? Ss 0:00 /sbin/klogd -x
> 2112 ? Ss 0:00 /usr/bin/dbus-daemon --system
> 2387 ? Ss 0:00 /usr/sbin/gpm -m /dev/input/mice -t exps2
> 2396 ? S 0:00 /usr/sbin/smartd --pidfile /var/run/smartd.pid
> 2407 ? Ss 0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -u 103:105 -g
> 2420 ? Ss 0:00 /usr/sbin/hald
> 2421 ? S 0:00 \_ hald-runner
> 2441 ? S 0:00 \_ hald-addon-input: Listening on /dev/input/event3 /dev/input/event2 /dev/input/event0
> 2449 ? S 0:00 \_ hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event
> 2460 ? S 0:01 \_ hald-addon-storage: polling /dev/hdc (every 2 sec)
> 2462 ? S 0:02 \_ hald-addon-storage: polling /dev/hdd (every 2 sec)
> 2464 ? S 0:01 \_ hald-addon-storage: polling /dev/sda (every 2 sec)
> 2475 ? Ss 0:00 /usr/sbin/gdm
> 2480 ? S 0:00 \_ /usr/sbin/gdm
> 2486 tty7 Ss+ 12:54 \_ /usr/bin/X :0 -audit 0 -auth /var/lib/gdm/:0.Xauth -nolisten tcp vt7
> 2623 ? Ss 0:00 \_ /usr/bin/icewm-session
> 2672 ? SNs 0:00 \_ icewmbg
> 2673 ? Ss 4:16 \_ icewm --restart
> 2674 ? Ss 0:00 \_ icewmtray
> 2510 ? Ss 0:00 /usr/sbin/cron
> 2566 tty1 Ss+ 0:00 /sbin/getty 38400 tty1
> 2567 tty2 Ss+ 0:00 /sbin/getty 38400 tty2
> 2570 tty3 Ss+ 0:00 /sbin/getty 38400 tty3
> 2571 tty4 Ss+ 0:00 /sbin/getty 38400 tty4
> 2572 tty5 Ss+ 0:00 /sbin/getty 38400 tty5
> 2573 tty6 Ss+ 0:00 /sbin/getty 38400 tty6
> 2621 ? S 0:00 /usr/bin/gnome-keyring-daemon -d --login
> 2670 ? S 0:00 /usr/bin/dbus-launch --exit-with-session /usr/bin/icewm-session
> 2671 ? Ss 0:00 /usr/bin/dbus-daemon --fork --print-pid 6 --print-address 9 --session
> 2677 ? S 2:52 gkrellm
> 2678 ? S 0:24 /usr/bin/rox -p=default
> 10665 ? S 0:00 \_ /usr/bin/rxvt-xpm -geometry 120x60 -fn 8x16 -sb
> 10666 pts/0 Ss 0:00 \_ bash
> 10683 pts/0 R+ 0:00 \_ ps fax
> frank@debian:~$
>
> That's it - I don't see anything strange in there.


--
Any technology distinguishable from magic is insufficiently advanced.
(*) http://blinkynet.net/comp/uip5.html Linux Counter #80292
- - http://www.faqs.org/rfcs/rfc1855.html Please, don't Cc: me.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Sat, Apr 26, 2008 at 04:31:25AM +0200, s. keeling wrote:
> Frank McCormick <fmccormick@videotron.ca>:
> I don't know icewm, but what's in icewmtray?

Something spawned by the window manager (on some strange keypress/mouse
button) might be a good candidate for the strange window.

However, icewmtray might be the "taskbar" or something like that, since
"man icewm" says: "icewm-session will invoke all needed programs like
icewmbg (background configurator) and icewmtray."

> I don't know rox either,

rox is a file manager:

<$> zgrep bin/rox ~/ftp.it.debian.org/debian/dists/Debian4.0r3/Contents-i386.gz
usr/bin/rox x11/rox-filer
usr/bin/rox-filer x11/rox-filer

apt-cache show rox-filer

> I've never heard of [aio].

as "ps fax" showed, it is a kernel thread, so it cannot be drawing a window

> > That's it - I don't see anything strange in there.

next time you might run this script:

#!/bin/sh
ps fax>~/ps_fax.pre # or "pstree -Aaplun" instead of "ps fax"
xkill # then quickly kill the window
ps fax>~/ps_fax.post
diff ~/ps_fax.pre ~/ps_fax.post

--
Chi usa software non libero avvelena anche te. Digli di smettere.
Informatica=arsenico: minime dosi in rari casi patologici, altrimenti letale.
Informatica=bomba: intelligente solo per gli stupidi che ci credono.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sat, 26 Apr 2008 04:31:25 +0200 (CEST)
"s. keeling" <keeling@nucleus.com> wrote:

> Frank McCormick <fmccormick@videotron.ca>:
> > On Fri, 25 Apr 2008 14:57:28 +0000
> > Tzafrir Cohen <tzafrir@cohens.org.il> wrote:
> > > On Tue, Apr 22, 2008 at 10:30:59AM -0400, Frank wrote:
> > > >
> > > > For the past week or so I noticed an empty window which pops up
> > > > seemingly at random on my screen. It looks like a terminal....but
> > > > with no cursor inside. The only way it can be closed is by using
> > > > xkill. I use IceWm and unless I kill it before logging out I can't
> > > > log out!
>
> Just suggestions, not answers, sorry. :-(
>
> xwininfo (in xbase-clients).

Yup. Ran it when I had that mysterious window up...it spewed out a lot
of info about it..including the fact it had no name...but I don't see any
solutions there.

>
> I don't know icewm, but what's in icewmtray?

Just an icon for the window

>I don't know rox either,
> but could it be syncing with a online db or something?

Doubt it - there isn't any unusual activity when the window is there. It
looks like a terminal window..black background with the usual icewm
decorations but no cursor inside.

>
> I've never heard of [aio].


Its apparently a library for asychronous input/output..standard stuff
from what I could find.

>
> I notice hald is probing each usb device every two seconds. I've no
> idea whether that's normal. Others can , please? I'm on etch
> with no hald.

That makes two of us...hald is a mystery

- --
Frank debian@videotron.ca
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIE0VtnQV1aTcQlJsRAsd/AKCBR/koVVYxbzUpnEWdqvBzMB4AzQCfZOq3
meHXSoa62VXUOh8Ideu1v4Y=
=0Zov
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sat, 26 Apr 2008 15:30:05 +0200
NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:

>
> next time you might run this script:
>
> #!/bin/sh
> ps fax>~/ps_fax.pre # or "pstree -Aaplun" instead of "ps fax"
> xkill # then quickly kill the window
> ps fax>~/ps_fax.post
> diff ~/ps_fax.pre ~/ps_fax.post
>

This is the diff file:

54c54
< 2631 ? Ss 0:00 \_ /usr/bin/icewm-session
- - ---
> 2631 ? Rs 0:00 \_ /usr/bin/icewm-session
56,57c56
< 2682 ? Ss 8:36 \_ icewm
< 2683 ? Ss 0:00 \_ icewmtray
- - ---
> 18358 ? RNs 0:00 \_ icewmbg -q
68c67
< 2686 ? S 5:47 gkrellm
- - ---
> 2686 ? R 5:47 gkrellm
70c69
< 15228 ? SL 0:20 \_ sylpheed
- - ---
> 15228 ? RL 0:20 \_ sylpheed
74,75c73,74
< 18353 pts/0 S+ 0:00 \_ /bin/sh ./window.sh
< 18354 pts/0 R+ 0:00 \_ ps fax
- - ---
> 18353 pts/0 R+ 0:00 \_ /bin/sh ./window.sh
> 18357 pts/0 R+ 0:00 \_ ps fax


What do you make of it ??


- - --
Frank debian@videotron.ca
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIFAepnQV1aTcQlJsRAr2YAJwJglIJ6Xu/1iq4EhA2GA/Zny48XgCdGzzo
v8E4LJ8w7MzIdv56LP5ykIo=
=XPR7
- -----END PGP SIGNATURE-----
- --

Change the world one loan at a time - visit Kiva.org to find out how





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIFAhinQV1aTcQlJsRAslgAJ0ZdniOeMatRShYTCVXLM 85OgsRDQCfYFx/
065m9Mok8mABjbBFXfeRM+8=
=h03k
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sat, 26 Apr 2008 15:30:05 +0200
NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:

>
> next time you might run this script:
>
> #!/bin/sh
> ps fax>~/ps_fax.pre # or "pstree -Aaplun" instead of "ps fax"
> xkill # then quickly kill the window
> ps fax>~/ps_fax.post
> diff ~/ps_fax.pre ~/ps_fax.post
>

This is the diff file:

54c54
< 2631 ? Ss 0:00 \_ /usr/bin/icewm-session
- ---
> 2631 ? Rs 0:00 \_ /usr/bin/icewm-session
56,57c56
< 2682 ? Ss 8:36 \_ icewm
< 2683 ? Ss 0:00 \_ icewmtray
- ---
> 18358 ? RNs 0:00 \_ icewmbg -q
68c67
< 2686 ? S 5:47 gkrellm
- ---
> 2686 ? R 5:47 gkrellm
70c69
< 15228 ? SL 0:20 \_ sylpheed
- ---
> 15228 ? RL 0:20 \_ sylpheed
74,75c73,74
< 18353 pts/0 S+ 0:00 \_ /bin/sh ./window.sh
< 18354 pts/0 R+ 0:00 \_ ps fax
- ---
> 18353 pts/0 R+ 0:00 \_ /bin/sh ./window.sh
> 18357 pts/0 R+ 0:00 \_ ps fax


What do you make of it ??


- --
Frank debian@videotron.ca
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIFAepnQV1aTcQlJsRAr2YAJwJglIJ6Xu/1iq4EhA2GA/Zny48XgCdGzzo
v8E4LJ8w7MzIdv56LP5ykIo=
=XPR7
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Sun, Apr 27, 2008 at 01:00:18AM -0400, Frank McCormick wrote:
> > ps fax>~/ps_fax.pre # or "pstree -Aaplun" instead of "ps fax"
> > xkill # then quickly kill the window
> > ps fax>~/ps_fax.post
> > diff ~/ps_fax.pre ~/ps_fax.post
> 56,57c56
> < 2682 ? Ss 8:36 \_ icewm
> < 2683 ? Ss 0:00 \_ icewmtray
> - - ---
> > 18358 ? RNs 0:00 \_ icewmbg -q
> What do you make of it ??

a process which disappeared after you killed the strange window is
responsable for the apparence of the strange window. So ...

If there is a difficulty in understanting what is old and what is new,
consider this:

$ echo "old">/tmp/old
$ echo "new">/tmp/new
$ diff /tmp/old /tmp/new
1c1
< old
---
> new

--
Chi usa software non libero avvelena anche te. Digli di smettere.
Informatica=arsenico: minime dosi in rari casi patologici, altrimenti letale.
Informatica=bomba: intelligente solo per gli stupidi che ci credono.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Sun, Apr 27, 2008 at 12:57:07AM -0400, Frank McCormick wrote:

[ snipping processes that merely changed their state ]

> 56,57c56
> < 2682 ? Ss 8:36 \_ icewm
> < 2683 ? Ss 0:00 \_ icewmtray
> - ---
> > 18358 ? RNs 0:00 \_ icewmbg -q

icewm disappeared? And you can still move windows around?

I slightly suspected icewmtray . Isn't it supported by
icewm-experimental alone, and not by the "standard" icewm package?

--
Tzafrir Cohen | tzafrir@jabber.org | VIM is
http://tzafrir.org.il | | a Mutt's
tzafrir@cohens.org.il | | best
ICQ# 16849754 | | friend


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, 27 Apr 2008 09:54:19 +0000
Tzafrir Cohen <tzafrir@cohens.org.il> wrote:

> On Sun, Apr 27, 2008 at 12:57:07AM -0400, Frank McCormick wrote:
>
> [ snipping processes that merely changed their state ]
>
> > 56,57c56
> > < 2682 ? Ss 8:36 \_ icewm
> > < 2683 ? Ss 0:00 \_ icewmtray
> > - ---
> > > 18358 ? RNs 0:00 \_ icewmbg -q
>
> icewm disappeared? And you can still move windows around?


Yes. Before I kill the window I can move it around. Afterwards things
are normal.
>
> I slightly suspected icewmtray . Isn't it supported by
> icewm-experimental alone, and not by the "standard" icewm package?
>


I dunno. Icewm was installed using aptitude. Icewm loads icewmtray and
a couple of other ice packages.
I still think its got something to do with Sylpheed because as far as I
can recall I have been or am reading mail when the window appears. I
could be wrong because when it appears it is very small, icon-sized so I
sometimes don't notice it immediately.


- --
Frank McCormick debian@videotron.ca
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIFKtknQV1aTcQlJsRAvyZAJwIxRqN/TAgsI+nwp7QXZ6RRJCdFgCfbBah
puuDJG7cKa4vR62myRZg73Q=
=uQg1
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, 27 Apr 2008 08:21:22 +0200
NN_il_Confusionar