I clicked a link from DuckDuckGo and a window popped up, obscuring the page I wanted to look at.
It indicated that my IP was selected to receive the iPhone from Pale Moon, for what seems to have been a survey.
I ran top in terminal and the only thing suspicious was a Debian-+ user running the command 'tor'.
Code: Select all
1624 debian-+ 20 0 58012 30060 10116 S 0.3 0.5 0:13.61 tor
The Debian-+ user continues to appear in brief, intermittent instances, including after I disconnected from the internet.
Here is what was running when I last saw the Debian-+ user.
I separated that entry with blank lines above and below, since bold will not work within code tags.
I hit control-c to stop top.
Code: Select all
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
2796 gt 20 0 2492308 472020 115408 S 5.0 7.9 25:56.71 palemoon
1304 root 20 0 486136 90068 72732 S 3.6 1.5 6:40.95 Xorg
2663 gt 20 0 971824 202076 78444 S 1.7 3.4 4:27.86 iridium-br+
4803 gt 20 0 533284 28744 22704 S 1.7 0.5 0:04.25 gnome-term+
2223 gt 20 0 1413468 163472 64740 S 1.0 2.7 7:07.25 cinnamon
2681 gt 20 0 952448 169456 70896 S 0.7 2.8 1:42.72 iridium-br+
4942 gt 20 0 24964 3092 2576 R 0.7 0.1 0:00.04 top
545 root -51 0 0 0 0 S 0.3 0.0 0:22.04 irq/28-iwl+
1624 debian-+ 20 0 58012 30060 10116 S 0.3 0.5 0:13.89 tor
4837 root 20 0 0 0 0 S 0.3 0.0 0:00.57 kworker/u8+
1 root 20 0 34184 4716 2648 S 0.0 0.1 0:02.02 init
2 root 20 0 0 0 0 S 0.0 0.0 0:00.02 kthreadd
3 root 20 0 0 0 0 S 0.0 0.0 0:00.03 ksoftirqd/0
5 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kworker/0:+
7 root 20 0 0 0 0 S 0.0 0.0 0:08.22 rcu_sched
8 root 20 0 0 0 0 S 0.0 0.0 0:00.00 rcu_bh
9 root rt 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
The iridium browser was also open, though it sees very limited use... mostly weather underground, google maps and youtube. I run it barefooted with no extensions or apps.