I was playing around with VNC on my Fedora Core 2 server and got it working is a short amount of time, I have to admit its not bad, but when vncserver is running I see some strange processes in the list when I do a ps ax from a command prompt. I'm a little worried about security, these seemingly randomly named processes show up only when vncserver has been running for a while.
Here are the processes I'm talking about from the ps ax command:
17493 ? RN 0:02 slip -root
17591 ? RN 0:00 rocks -root

The names above (slip and rocks) will change to something else like "deluxe" after a while, and they always have -root after them. Has anyone else seen this before, or know what it is?

it's xscreensaver, try it:

/usr/lib/xscreensaver/deluxe
/usr/lib/xscreensaver/slip
/usr/lib/xscreensaver/rocks

That would explain the way those names change, probably every 10 minutes or so. Thanks! I just wanted to make sure I didn't have some unauthorized login or something.

A little follow up, in my case it happens to be in /usr/X11R6/lib/xscreensaver/ , just some FYI