59

I checked in htop what is running on the system and found/saw something that I don't know what it is, Windows Desktop and explorer.exe. I'm using Ubuntu Linux and there is no Windows on this laptop.

Here is the image of the process

Output of htop, showing "C:\Windows\system32\explorer.exe /desktop" & "C:\Windows\system32\services.exe"

How can I find out what these are?

~$ ps -aux | grep "explorer.exe\|services.exe"
root      3110  0.0  0.0 2645728  352 ?        Ssl  06:45   0:00 C:\windows\system32\services.exe
root      3413  0.0  0.0 2658592 1440 ?        Ssl  06:45   0:00 C:\windows\system32\explorer.exe /desktop
root     20817  0.0  0.0  14360  2408 pts/4    S+   15:20   0:00 grep --color=auto explorer.exe\|services.exe
  • 69
    I knew it! The truth has finally been revealed! Ubuntu was Windows all along! – Matti Virkkunen Apr 10 '17 at 23:48
  • 16
    Are you... running your GUI session as root? I hope you aren't, because that's a very bad idea as far as security is concerned. – Léo Lam Apr 11 '17 at 9:41
  • @LéoLam, Yes, I'm.. I'm not that familiar yet with creating users etc. – VLS Apr 11 '17 at 11:17
  • 4
    @LéoLam oops! don't do that! – dalearn Apr 12 '17 at 1:14
50

Some Windows apps running in Wine or front-ends to Wine like PlayOnLinux or Crossover leave explorer.exe and other Windows executables open after they are closed. Try running some of your Wine applications one by one and check in htop for explorer.exe after you close them.

Or run this command in the terminal:

ps -aux | grep "explorer.exe\|services.exe"

The two Windows processes in your question have been running for more than 8 hours. Possibly they have been running since right after Ubuntu booted. Kill the PIDs of explorer.exe and services.exe and check if these two processes come back afterwards. To kill the PIDs of explorer.exe and services.exe in the example in your question use this command:

kill 3413 3110  

The results of running the above command showed that the two Windows processes have been running since startup. Open the built-in Startup Applications app which shows a list of all Additional startup programs in your operating system.

Startup Applications showed only a normal Ubuntu startup program in the list of additional startup programs. Run the following command right after the next time you start up Ubuntu to show what process forked what so you may get a better idea what process is calling your two Windows processes.

ps auxf
  • 2
    I don't have anything windows related. Not even Wine.. I have only mono installed but I didn't run it since 1 month.. I'm not familiar with linux that much and I'm not what is Wine at all.. – VLS Apr 10 '17 at 12:05
  • 2
    There is a built-in Ubuntu application to see startup programs called Startup Applications. Search for Startup Applications in the Dash and click on the icon to open it. – karel Apr 10 '17 at 13:05
  • 2
    Those are very definitely some version of wine, even if it's built-in to another program - I know of no other linux program which would report C:\ paths like that, and wine definitely does that for programs running inside it. Are you sure that you don't have wine or another cross-over app using wine installed? – daboross Apr 11 '17 at 1:09
  • 3
    @VLS Mono can use wine, yes. It may have automatically installed some wine components when you installed mono. Also wine may have been automatically installed when you tried to install a windows application, possibly without you realising it (not sure if Ubuntu does that out-of-the-box, I normally disable automatic installation and such things). – Micheal Johnson Apr 11 '17 at 7:43
  • 13
    Other examples of programs using Wine without telling you: TeamViewer, Picasa. – reinierpost Apr 11 '17 at 8:54
18

Look at the /proc filesystem:

ls -l /proc/3413/exe

And it will show you the binary of the process. Under the directory, there are more pseudofiles giving useful information, and another useful one is cmd,

cat /proc/3413/cmd

giving you the arguments used to launch the process (if any).

  • Use of the direct approach for the win. – Joshua Apr 12 '17 at 2:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.