So I had Linux Mint running on my laptop, just installed it a month ago.

It has a small hard drive, just 160gb, and I noticed shortly after installing the system, it ballooned to 80-some gigabytes full, even though I only installed a few common programs and had a few files, maybe 1-2gb worth. I looked through my home folder but there wasn't anything near that size. So over the past few weeks, I've noticed the hard drive getting more full on the order of tens of gigs, even though I wasn't downloading much of anything, and I clear my browser cache and other such files regularly.

I was determined to discover what was going on with the system, so I dug through all the directories the other day. I found in /root three suspicious folders with salted titles, that I knew nothing about.

It looks as if two of the files are folders that appear to have 0 bytes with hundreds of thousands of items (????). I tried opening them, but after leaving my computer working on opening them for over an hour, it still hadn't loaded, meaning that there's some absurd number of files there. The third file shows 77.9gb, and it appears to be some sort of binary.

My working theory is that this has to be some sort of malware that is saving keystrokes / screenshots / whatever to the disk, storing them encrypted, for later retrieval. I check my packets with Wireshark from time to time, and I haven't noticed anything abnormal, but sophisticated malware would stop transmitting as soon as Wireshark is turned on....

Does anybody have a better explanation as to what might be going on? Screenshot below.

enter image description here

Edited, removed indentions.

  • 5
    I doubt a keylogger would generate that much data.. I doubt it's even possible to type 80 GB worth of text in that period of time. Screenshots or recordings (mic, webcam or screen recording) maybe. In any case, don't try to open the files with a GUI. Use a terminal; to get a glimpse of the files you can use the head command. – user42178 Mar 14 '15 at 15:06
  • 2
    Can you add a hexdump of the first 512 bytes of that file? Use hexdump -C filename. – ott-- Mar 14 '15 at 18:14
  • also file <filename> and stat <filename> may give some helpfull info. – Mausy5043 Jan 8 '18 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.