Why is this X11 application open on my Macbook without my having installed/opened it??

June 6, 2012 7:42 AM

Why is this X11 application open on my Mac all of a sudden?

I came back to my 2007 Macbook from a few days of not having used it, and I was surprised to see X11 and Wine open in my dock. I have no recollection of knowing about or having installed X11 (although I have heard of/seen Wine on my computer before), so I immediately looked it up and now have a vague idea of what it does (I'm computer savvy enough but not that savvy). However, my computer was also noticeably slower than usual when browsing the web, and the spinning rainbow beach ball kept making guest appearances--which hasn't happened since I increased my computer's memory about a year ago.

Pangs of worry coursed through my veins about the possibility of spyware infection, so I downloaded the trial version of MacScan, which is now running. I also followed some advice and cleared the cache via Terminal, which did speed things up in the browser.

After Flashback came to the fore in April, I did do what I thought was a scan of my computer for it, especially since I remember clicking on something to update Flash. It came back negative. But now I'm doubting the validity of the scan and wondering if this has anything to do with the recent X11/Wine appearance on my dock.

So with that in mind, what kind of action should I take? Any ideas where this mysterious X11 came from, or was it already on my computer and some other action caused it and Wine to open automatically? Is there a way to check a history log to see what was going on when they were opened? Or am I needlessly getting worked up??

I should also note that no one has had physical access to my computer during these last few days, so it's not that someone was using it and opening up applications, etc.

Thank you!

posted by trampoliningisfun to computers & internet (10 answers total)

X11 is a window-management software for a lot of flavors of Unix and Linux. For a long time, you needed X11 to run some programs that had been ported over from those environments. I think GIMP and some versions of StarOffice, in particular. I think(?) that these days you can run them in the OS X finder.

So you might have had some program open that needed X11, especially if you're using an older version of OS X.

The presence of X11 doesn't, by itself, make me think of spyware or malware, although of course any odd behavior should make you wonder a little bit, and you might want to make sure that you don't have something else masquerading as X11.
posted by gauche at 7:48 AM on June 6, 2012

I should maybe add that you could (and maybe still can?) download the X11 application from Apple.
posted by gauche at 7:49 AM on June 6, 2012

>The presence of X11 doesn't, by itself, make me think of spyware or malware

And it shouldn't. Every version of OS X since 10.5 ships with X11 installed by default.
posted by BrandonW at 7:50 AM on June 6, 2012 [1 favorite]

I use X11 daily when I SSH into the lab's Unix computing cluster; rather than just interacting with MATLAB through a shell, I can see the normal MATLAB desktop, editor, etc. It opened as a result of opening some application or another, possible Wine. Whether you opened that application or not is the question when you're wondering about being compromised.

If you're that worried, nuke from orbit: format and reinstall the OS. A clean install is a good occasional maintenance measure.
posted by supercres at 7:51 AM on June 6, 2012

In order for wine to run on OS X, I think it needs X11. So, the questions isn't why X11 was running, because it was launched by wine most likely. How did wine get launched? Did you accidentally open wine somehow? Did you open a file that (for whatever reason) is opened by wine by default?
posted by bessel functions seem unnecessarily complicated at 8:20 AM on June 6, 2012

Go to your force quit menu and see what's running? There's probably some unix app you installed.
posted by empath at 10:45 AM on June 6, 2012

If you start some programs that require X11, they are smart enough to start X11 automagically, so I can imagine a cascade where, as bessel functions suggests, you opened something that thought it needed Wine to open / run, so it started Wine, which started X11 automatically.
posted by BrashTech at 12:02 PM on June 6, 2012

Well unfortunately I closed Wine without thinking, then started to make the correlation of "hey, this is weird." Does Wine automatically open for some programs, or is it something that is always manually opened?

As a bit of an update, MacScan is still scanning--almost 12 hours later now--and so far no malware has been detected (just some tracking cookies).

BUT! I am really starting to get freaked out, because when I came home, System Profiler was open--and I definitely did NOT open that this morning.

Thanks for all the responses so far, but please note that a few of them use lexicon that is way above my level!!
posted by trampoliningisfun at 7:28 PM on June 6, 2012

If you installed a windows program, wine will run automatically.
posted by empath at 7:52 PM on June 6, 2012

With spotlight, it's really easy to accidentally launch apps on the mac. Launching X11 would take Cmd-Space X Enter. That's really close to Cmd-X, the common cut command. You probably launched it by accident.

Why Wine is running I couldn't say.
posted by chairface at 6:58 AM on June 7, 2012