[SOLVED] Is this an indication I am being hacked or spied on?

Novatian · 03-30-2020, 04:10 AM

Suspicious readout during live USB repairs in Mint 19. Hacking, spyware, faulty SSD?

Is this read out from my terminal a sign of a hacker?

Quote:

[liveuser@localhost ~]$ su
[root@localhost liveuser]# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
loop0 7:0 0 1.4G 1 loop
loop1 7:1 0 5G 1 loop
├─live-rw 253:0 0 5G 0 dm /
└─live-base 253:1 0 5G 1 dm
loop2 7:2 0 32G 0 loop
└─live-rw 253:0 0 5G 0 dm /
sda 8:0 0 119.2G 0 disk
└─sda1 8:1 0 119.2G 0 part
sdb 8:16 1 1.9G 0 disk
└─sdb1 8:17 1 1.4G 0 part /run/initramfs/live
sr0 11:0 1 1024M 0 rom
[root@localhost liveuser]# sudo fsck /dev/sdb1
fsck from util-linux 2.33.2
[root@localhost liveuser]# sudo fsck /dev/sdb1
fsck from util-linux 2.33.2
[root@localhost liveuser]# sudo fsck /dev sda1
fsck from util-linux 2.33.2
Usage: fsck.ext2 [-panyrcdfktvDFV] [-b superblock] [-B blocksize]
[-l|-L bad_blocks_file] [-C fd] [-j external_journal]
[-E extended-options] [-z undo_file] device

Emergency help:
-p Automatic repair (no questions)
-n Make no changes to the filesystem
-y Assume "yes" to all questions
-c Check for bad blocks and add them to the badblock list
-f Force checking even if filesystem is marked clean
-v Be verbose
-b superblock Use alternative superblock
-B blocksize Force blocksize when looking for superblock
-j external_journal Set location of the external journal
-l bad_blocks_file Add to badblocks list
-L bad_blocks_file Set badblocks list
-z undo_file Create an undo file
[root@localhost liveuser]# sudo fsck /dev/sda1
fsck from util-linux 2.33.2
e2fsck 1.44.6 (5-Mar-2019)
/dev/sda1 contains a file system with errors, check forced.
Pass 1: Checking inodes, blocks, and sizes
Inodes that were part of a corrupted orphan linked list found. Fix<y>? yes
Inode 5242915 was part of the orphaned inode list. FIXED.
Inode 5242967 was part of the orphaned inode list. FIXED.
Inode 5242975 was part of the orphaned inode list. FIXED.
Inode 5243016 was part of the orphaned inode list. FIXED.
Inode 5243363 was part of the orphaned inode list. FIXED.
Inode 5243383 was part of the orphaned inode list. FIXED.
Deleted inode 5243395 has zero dtime. Fix<y>? yes
Inode 5243401 was part of the orphaned inode list. FIXED.
Inode 5243422 was part of the orphaned inode list. FIXED.
Inode 5243424 was part of the orphaned inode list. FIXED.
Inode 5243441 was part of the orphaned inode list. FIXED.
Inode 5243473 was part of the orphaned inode list. FIXED.
Inode 5247711 was part of the orphaned inode list. FIXED.
Inode 5255833 was part of the orphaned inode list. FIXED.
Inode 5384923 was part of the orphaned inode list. FIXED.
Inode 5391666 was part of the orphaned inode list. FIXED.
Inode 5406369 was part of the orphaned inode list. FIXED.
Inode 5406370 was part of the orphaned inode list. FIXED.
Inode 5832448 was part of the orphaned inode list. FIXED.
Inode 6424820 was part of the orphaned inode list. FIXED.
Inode 6424841 was part of the orphaned inode list. FIXED.
Inode 6553855 was part of the orphaned inode list. FIXED.
Inode 6553915 was part of the orphaned inode list. FIXED.
Inode 6553943 was part of the orphaned inode list. FIXED.
Inode 7474840 was part of the orphaned inode list. FIXED.
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
Block bitmap differences: -(3476608--3476724) -(6368275--6368290) -(21004520--21004527) -(22464591--22464598) -(22695753--22695766) -(22712881--22712888) -(22756726--22756733) -(22756744--22756751) -(22785092--22785099) -(22864053--22864073) -(22866015--22866022) -(22898421--22898428) -(22915072--22915492) -(22921643--22921650) -(22924072--22924085) -22924525 -(22924834--22924841) -25706025 -(26344335--26344342) -(27362678--27362685) -(30807040--30808063)
Fix<y>? yes
Free blocks count wrong for group #106 (10994, counted=11111).
Fix<y>? yes
Free blocks count wrong for group #194 (12858, counted=12874).
Fix<y>? yes
Free blocks count wrong for group #641 (17378, counted=17386).
Fix<y>? yes
Free blocks count wrong for group #685 (20780, counted=20788).
Fix<y>? yes
Free blocks count wrong for group #692 (9098, counted=9112).
Fix<y>? yes
Free blocks count wrong for group #693 (13117, counted=13125).
Fix<y>? yes
Free blocks count wrong for group #694 (16964, counted=16980).
Fix<y>? yes
Free blocks count wrong for group #695 (25551, counted=25559).
Fix<y>? yes
Free blocks count wrong for group #697 (9589, counted=9618).
Fix<y>? yes
Free blocks count wrong for group #698 (3515, counted=3523).
Fix<y>? yes
Free blocks count wrong for group #699 (24880, counted=25332).
Fix<y>? yes
Free blocks count wrong for group #784 (12433, counted=12434).
Fix<y>? yes
Free blocks count wrong for group #803 (22136, counted=22144).
Fix<y>? yes
Free blocks count wrong for group #835 (23201, counted=23209).
Fix<y>? yes
Free blocks count wrong for group #940 (28837, counted=29861).
Fix<y>? yes
Free blocks count wrong (16730813, counted=17051883).
Fix<y>? yes
Inode bitmap differences: -5242915 -5242967 -5242975 -5243016 -5243363 -5243383 -5243395 -5243401 -5243422 -5243424 -5243441 -5243473 -5247711 -5255833 -5384923 -5391666 -(5406369--5406370) -5832448 -6424820 -6424841 -6553855 -6553915 -6553943 -7474840
Fix<y>? yes
Free inodes count wrong for group #640 (3431, counted=3444).
Fix<y>? yes
Free inodes count wrong for group #641 (5382, counted=5383).
Fix<y>? yes
Free inodes count wrong for group #657 (0, counted=1).
Fix<y>? yes
Free inodes count wrong for group #658 (485, counted=486).
Fix<y>? yes
Free inodes count wrong for group #659 (310, counted=312).
Fix<y>? yes
Free inodes count wrong for group #711 (0, counted=1).
Fix<y>? yes
Free inodes count wrong for group #784 (350, counted=352).
Fix<y>? yes
Directories count wrong for group #784 (1452, counted=1451).
Fix<y>? yes
Free inodes count wrong for group #800 (1172, counted=1175).
Fix<y>? yes
Free inodes count wrong for group #912 (1, counted=2).
Fix<y>? yes
Free inodes count wrong (5836167, counted=5930950).
Fix<y>? yes

/dev/sda1: ***** FILE SYSTEM WAS MODIFIED *****
/dev/sda1: 1884218/7815168 files (0.5% non-contiguous), 14206485/31258368 blocks
[root@localhost liveuser]#

descendant_command · 03-30-2020, 04:47 AM

Keith Hedger · 03-30-2020, 04:48 AM

pretty standard op from fsck, oh and please use code tags

RickDeckard · 04-10-2020, 11:29 AM

That's a sign of an unclean shutdown.