For the past week or so I noticed an empty window which pops up seemingly
at random on my screen. It looks like a terminal....but with no cursor
inside. The only way it can be closed is by using xkill. I use IceWm and
unless I kill it before logging out I can't log out!

I'd appreciate any tips on tracking this thing down.

Frank

---


Change the world one loan at a time - visit Kiva.org to find out how







--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

> * From: Frank <debian@videotron.ca>
>For the past week or so I noticed an empty window which pops up

try htop or pstree or many other similar tools


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 16:57:08 +0200
NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:

> > * From: Frank <debian@videotron.ca>
> >For the past week or so I noticed an empty window which pops up
>
> try htop or pstree or many other similar tools


As far as I can see neither show anything unususal, How can I find out
what process owns the window ?



- --

Change the world one loan at a time - visit Kiva.org to find out how





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIDgZinQV1aTcQlJsRArhvAJ4nZpafAwxAI0dgcCadDz jTwdwyeQCfVfGD
Vnq0T1YkZqymABF/2dFACn4=
=NnEx
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

On Tue, Apr 22, 2008 at 11:38:06AM -0400, Frank McCormick wrote:
> On Tue, 22 Apr 2008 16:57:08 +0200
> NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:
> > > * From: Frank <debian@videotron.ca>
> > >For the past week or so I noticed an empty window which pops up
> > try htop or pstree or many other similar tools
> As far as I can see neither show anything unususal,

If *really* you can identify all processes as shown by, say, htop in
tree mode run by root, and you are sure than none of them gives the
unusual window, then either your box has been hacked or you have found a
big bug (in htop or the kernel), or the process is really run by another
host and only connects to your X server (but then you should see the
connection with netstat, either directly as tcp connection, or as a tcp
ssh connection plus a unix socket). Also note that the xkill man page
suggests at the end xwininfo

So I would double ckeck. Closing all not indispensable processes might
help, as also using tree mode (the window should be in the tree of
processes after the Xserver process, and the parent processes might give
an idea of which process spawned the window process. Unless the window
has been orphaned)

--
Chi usa software non libero avvelena anche te. Digli di smettere.
Informatica=arsenico: minime dosi in rari casi patologici, altrimenti letale.
Informatica=bomba: intelligente solo per gli stupidi che ci credono.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 20:35:45 +0200
NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:

> On Tue, Apr 22, 2008 at 11:38:06AM -0400, Frank McCormick wrote:
> > On Tue, 22 Apr 2008 16:57:08 +0200
> > NN_il_Confusionario <pinkof.pallus@tiscalinet.it> wrote:
> > > > * From: Frank <debian@videotron.ca>
> > > >For the past week or so I noticed an empty window which pops up
> > > try htop or pstree or many other similar tools
> > As far as I can see neither show anything unususal,
>
> If *really* you can identify all processes as shown by, say, htop in
> tree mode run by root, and you are sure than none of them gives the
> unusual window, then either your box has been hacked or you have found a
> big bug (in htop or the kernel), or the process is really run by another
> host and only connects to your X server (but then you should see the
> connection with netstat, either directly as tcp connection, or as a tcp
> ssh connection plus a unix socket). Also note that the xkill man page
> suggests at the end xwininfo

I will have to wait now until I get the window back - I killed it and
rebooted earlier. I'm not sure what creates it so I'll have to wait.

But all your suggestions seem to be good ones



- --

Change the world one loan at a time - visit Kiva.org to find out how





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIDm0fnQV1aTcQlJsRAotTAJ476wTBD79mzeDHqKtabY oW3Yg9iACgkoEF
Ga++LWyCaRxoZjAXpruMNdA=
=nitO
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Frank wrote:

For the past week or so I noticed an empty window which pops up seemingly
at random on my screen. It looks like a terminal....but with no cursor
inside. The only way it can be closed is by using xkill. I use IceWm and
unless I kill it before logging out I can't log out!

I'd appreciate any tips on tracking this thing down.

Frank

---


Change the world one loan at a time - visit Kiva.org to find out how










There is an xapp that you can run, then click on a screen (or x-app) and
it will tell you the source of the app. That is the good news, the bad
news is I can't remember what it is: perhaps xtrace?

--
Damon L. Chesser
damon@damtek.com
http://www.linkedin.com/in/dchesser



--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 19:06:04 -0400
"Damon L. Chesser" <damon@damtek.com> wrote:

> Frank wrote:
> > For the past week or so I noticed an empty window which pops up
> > seemingly at random on my screen. It looks like a terminal....but with
> > no cursor inside. The only way it can be closed is by using xkill. I
> > use IceWm and unless I kill it before logging out I can't log out!
> >
> There is an xapp that you can run, then click on a screen (or x-app) and
> it will tell you the source of the app. That is the good news, the bad
> news is I can't remember what it is: perhaps xtrace?

I think it's xwininfo you're thinking about - I'm waiting for this
mysterious window to re-appear. Too bad I don't know how to make it happen!


Thanks

- --

Change the world one loan at a time - visit Kiva.org to find out how





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIDoLanQV1aTcQlJsRAti3AJ9z+Y7jXluhoLffpDfqV9 XXjjZJHACePrC0
bU7mSuNTvDoR2ynQPhpCw2w=
=8R9A
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Frank McCormick wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 19:06:04 -0400
"Damon L. Chesser" <damon@damtek.com> wrote:



Frank wrote:


For the past week or so I noticed an empty window which pops up
seemingly at random on my screen. It looks like a terminal....but with
no cursor inside. The only way it can be closed is by using xkill. I
use IceWm and unless I kill it before logging out I can't log out!



There is an xapp that you can run, then click on a screen (or x-app) and
it will tell you the source of the app. That is the good news, the bad
news is I can't remember what it is: perhaps xtrace?



I think it's xwininfo you're thinking about - I'm waiting for this
mysterious window to re-appear. Too bad I don't know how to make it happen!


Thanks

- --


Change the world one loan at a time - visit Kiva.org to find out how





-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIDoLanQV1aTcQlJsRAti3AJ9z+Y7jXluhoLffpDfqV9 XXjjZJHACePrC0
bU7mSuNTvDoR2ynQPhpCw2w=
=8R9A
-----END PGP SIGNATURE-----




Yup, that is the name. Checked, I have it, tried it, it works.

--
Damon L. Chesser
damon@damtek.com
http://www.linkedin.com/in/dchesser


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 18:56:26 -0400
Frank McCormick <debian@videotron.ca> wrote:

> > > > >For the past week or so I noticed an empty window which pops up
> > > > try htop or pstree or many other similar tools
> > > As far as I can see neither show anything unususal,
> >
> > If *really* you can identify all processes as shown by, say, htop in
> > tree mode run by root, and you are sure than none of them gives the
> > unusual window, then either your box has been hacked or you have found
> > a big bug (in htop or the kernel), or the process is really run by
> > another host and only connects to your X server (but then you should
> > see the connection with netstat, either directly as tcp connection, or
> > as a tcp ssh connection plus a unix socket). Also note that the xkill
> > man page suggests at the end xwininfo
>
> I will have to wait now until I get the window back - I killed it and
> rebooted earlier. I'm not sure what creates it so I'll have to wait.

Got the weird window back tonight - it may have something to do with (I
think) my Sylpheed mail reader. At least that's what I was using when I
noticed it.

frank@debian:~$ xwininfo

xwininfo: Please select the window about which you
would like information by clicking the
mouse in that window.

xwininfo: Window id: 0xc00008 (has no name)
^^^^^^^^^^^^ first time I've seen this!!

Absolute upper-left X: 82
Absolute upper-left Y: 127
Relative upper-left X: 0
Relative upper-left Y: 0
Width: 185
Height: 175
Depth: 24
Visual Class: TrueColor
Border width: 0
Class: InputOutput
Colormap: 0x20 (installed)
Bit Gravity State: ForgetGravity
Window Gravity State: NorthWestGravity
Backing Store State: NotUseful
Save Under State: no
Map State: IsViewable
Override Redirect State: no
Corners: +82+127 -1413+127 -1413-748 +82-748
-geometry 185x175+82+127


This is after I enlarged it - when it first appears its very small so I
guess it often goes unnoticed.

It's got me baffled...but that's not very hard!

BTW I am running Sid/Lenny


- --
Frank McCormick debian@videotron.ca
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIESe7nQV1aTcQlJsRAsIDAKCSPU4I6Fh87n6rOrnBOA e2OVBRkgCaA4Ry
PrAQ7fjVTIGbv4XmpaVTepQ=
=AwzK
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 22 Apr 2008 18:56:26 -0400
Frank McCormick <debian@videotron.ca> wrote:

> > > > >For the past week or so I noticed an empty window which pops up
> > > > try htop or pstree or many other similar tools
> > > As far as I can see neither show anything unususal,
> >
> > If *really* you can identify all processes as shown by, say, htop in
> > tree mode run by root, and you are sure than none of them gives the
> > unusual window, then either your box has been hacked or you have found
> > a big bug (in htop or the kernel), or the process is really run by
> > another host and only connects to your X server (but then you should
> > see the connection with netstat, either directly as tcp connection, or
> > as a tcp ssh connection plus a unix socket). Also note that the xkill
> > man page suggests at the end xwininfo
>
> I will have to wait now until I get the window back - I killed it and
> rebooted earlier. I'm not sure what creates it so I'll have to wait.

Got the weird window back tonight - it may have something to do with (I
think) my Sylpheed mail reader. At least that's what I was using when I
noticed it.

frank@debian:~$ xwininfo

xwininfo: Please select the window about which you
would like information by clicking the
mouse in that window.

xwininfo: Window id: 0xc00008 (has no name)
^^^^^^^^^^^^ first time I've seen this!!

Absolute upper-left X: 82
Absolute upper-left Y: 127
Relative upper-left X: 0
Relative upper-left Y: 0
Width: 185
Height: 175
Depth: 24
Visual Class: TrueColor
Border width: 0
Class: InputOutput
Colormap: 0x20 (installed)
Bit Gravity State: ForgetGravity
Window Gravity State: NorthWestGravity
Backing Store State: NotUseful
Save Under State: no
Map State: IsViewable
Override Redirect State: no
Corners: +82+127 -1413+127 -1413-748 +82-748
-geometry 185x175+82+127


This is after I enlarged it - when it first appears its very small so I
guess it often goes unnoticed.

It's got me baffled...but that's not very hard!

BTW I am running Sid/Lenny


- -
- --

Change the world one loan at a time - visit Kiva.org to find out how





- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIESe7nQV1aTcQlJsRAsIDAKCSPU4I6Fh87n6rOrnBOA e2OVBRkgCaA4Ry
PrAQ7fjVTIGbv4XmpaVTepQ=
=AwzK
- -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD4DBQFIEStdnQV1aTcQlJsRAoRJAJwLok/gAxFBvxzBIM+BAPyKT7hMrwCXcpzu
30PXDLmQySTYAyb8/dVXDA==
=VTSd
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org