The apparent rabid malware named wnck-applet

[Bret Busby]

Hello.

In inadvertently pressing an unknown key or key combination, Arora
went into an endless loop of loading and reloading, incessanly loading
hundreds of windows, and, using both the "Force a misbehaving
application to quit", and, "kill -9 <pid for arora>", repeatedly, have
failed.

Running top, showed the process named wnck-applet taking about 98-100% of "%CPU"

searching on the process name, I found many other people, over about
the last decade or so, have experienced similar problems with that
applet.

Other than it being the apparent rabid malware instrument of sabotage,
does it serve any useful purpose, or, can it be excised?

I note that, since I started composing this message, both that applet,
and, arora, have disappeared, from top, and, aftyer about an hour of
unsuccessfully trying to kill it, arora has finally disappeared from
the task bar, and the memory and CPU usage, and, the system load
average, have each returned to what they were, before the attack. It
is as is they sensed me raising the problem on this list.

So, regarding the wnck applet, other than it being an apparent rabid
malware instrument of sabotage, does it serve any useful purpose, or,
can it be excised?
--
Bret Busby
Armadale
West Australia
..............

"So once you do know what the question actually is,
you'll know what the answer means."
- Deep Thought,
Chapter 28 of Book 1 of
"The Hitchhiker's Guide to the Galaxy:
A Trilogy In Four Parts",
written by Douglas Adams,
published by Pan Books, 1992

....................................................

[Bret Busby]

Post by Bret Busby
Hello.
In inadvertently pressing an unknown key or key combination, Arora
went into an endless loop of loading and reloading, incessanly loading
hundreds of windows, and, using both the "Force a misbehaving
application to quit", and, "kill -9 <pid for arora>", repeatedly, have
failed.
Running top, showed the process named wnck-applet taking about 98-100% of "%CPU"
searching on the process name, I found many other people, over about
the last decade or so, have experienced similar problems with that
applet.
Other than it being the apparent rabid malware instrument of sabotage,
does it serve any useful purpose, or, can it be excised?
I note that, since I started composing this message, both that applet,
and, arora, have disappeared, from top, and, aftyer about an hour of
unsuccessfully trying to kill it, arora has finally disappeared from
the task bar, and the memory and CPU usage, and, the system load
average, have each returned to what they were, before the attack. It
is as is they sensed me raising the problem on this list.
So, regarding the wnck applet, other than it being an apparent rabid
malware instrument of sabotage, does it serve any useful purpose, or,
can it be excised?

Oh, and the affected computer, was my other main use computer, and,
both that computer, and, this computer, are running UbuntuMATE 16.04.x
--
Bret Busby
Armadale
West Australia
..............

"So once you do know what the question actually is,
you'll know what the answer means."
- Deep Thought,
Chapter 28 of Book 1 of
"The Hitchhiker's Guide to the Galaxy:
A Trilogy In Four Parts",
written by Douglas Adams,
published by Pan Books, 1992

....................................................

[Oliver Grawert]

hi,

Post by Bret Busby
Hello.
In inadvertently pressing an unknown key or key combination, Arora
went into an endless loop of loading and reloading, incessanly
loading
hundreds of windows, and, using both the "Force a misbehaving
application to quit", and, "kill -9 <pid for arora>", repeatedly, have
failed.
Running top, showed the process named wnck-applet taking about 98-
100% of "%CPU"

let me guess, you are running a mate desktop ...
wnck-applet is part of the old gnome2 panel, seems your desktop simply
has a bug that you should report ... wnck-applet manages the workspace
switcher and task list IIRC 

this is definitely not any malware [1] issue :)

ciao
oli

[1] https://en.wikipedia.org/wiki/Malware

[... Malware (a portmanteau for malicious software) is any software
intentionally designed to cause damage to a computer, server or
computer network ...]

[Bret Busby]

Post by Oliver Grawert
hi,

Post by Bret Busby
Hello.
In inadvertently pressing an unknown key or key combination, Arora
went into an endless loop of loading and reloading, incessanly loading
hundreds of windows, and, using both the "Force a misbehaving
application to quit", and, "kill -9 <pid for arora>", repeatedly, have
failed.
Running top, showed the process named wnck-applet taking about 98-
100% of "%CPU"

let me guess, you are running a mate desktop ...
wnck-applet is part of the old gnome2 panel, seems your desktop simply
has a bug that you should report ... wnck-applet manages the workspace
switcher and task list IIRC
this is definitely not any malware [1] issue :)
ciao
oli
[1] https://en.wikipedia.org/wiki/Malware
[... Malware (a portmanteau for malicious software) is any software
intentionally designed to cause damage to a computer, server or
computer network ...]

Hello.

Thank you for your explanation.

Unfortunately, "the UbuntuMATE people" apparently prohibit email
communications, and, prohibit support mailing lists, and, in keeping
with the term published on the UbuntuMATE web site homepage; "For a
retrospective future", I am not a "social media" or iirc user, so, I
suppose that all I can do, is, as said by Ford Prefect, in his review,
"change the status to Mostly Harmless", for UbuntuMATE.
--
Bret Busby
Armadale
West Australia
..............

"So once you do know what the question actually is,
you'll know what the answer means."
- Deep Thought,
Chapter 28 of Book 1 of
"The Hitchhiker's Guide to the Galaxy:
A Trilogy In Four Parts",
written by Douglas Adams,
published by Pan Books, 1992

....................................................

[Oliver Grawert]

hi,

Post by Bret Busby
Unfortunately, "the UbuntuMATE people" apparently prohibit email
communications, and, prohibit support mailing lists,

well, try:
https://bugs.launchpad.net/ubuntu/+source/mate-panel/+filebug

(or run "ubuntu-bug mate-panel" on commandline)

ciao
oli

[Tom H]

Post by Bret Busby
Unfortunately, "the UbuntuMATE people" apparently prohibit email
communications, and, prohibit support mailing lists, and, in keeping
with the term published on the UbuntuMATE web site homepage; "For a
retrospective future", I am not a "social media" or iirc user, so, I
suppose that all I can do, is, as said by Ford Prefect, in his review,
"change the status to Mostly Harmless", for UbuntuMATE.

https://bugs.launchpad.net/ubuntu-mate