Suspicious file in /tmp directory (Cloudguard.me.pem)

[dougmon]

Hi:

I'm not sure about this, I could be worrying about nothing, but...

There's a file in my /tmp directory called cloudguard.me.pem -- I don't know if it's related to Cloudguard adware or not, but since I don't know what it is, I'm a little paranoid.

Does anyone know what this file is?

Thanks,

Doug

 

[cruisin]

A pem file is a digital certificate (like the one that signs SSL connections). A quick look (https://superuser.com/questions/111...the-invalid-https-certificate-is-comming-from) suggests that you have some kind of malware, possibly taking over your DNS records (to redirect websites to somewhere else).

It shouldn’t cause issues deleting it, being in the tmp directory. If it comes back (after a while or a reboot) you might have a problem.

 

[dougmon]

A pem file is a digital certificate (like the one that signs SSL connections). A quick look (https://superuser.com/questions/111...the-invalid-https-certificate-is-comming-from) suggests that you have some kind of malware, possibly taking over your DNS records (to redirect websites to somewhere else).

It shouldn’t cause issues deleting it, being in the tmp directory. If it comes back (after a while or a reboot) you might have a problem.

Thanks. I somehow couldn't find that using my (not so great) googling. I believe I tracked it down to a program I installed a few days ago; I removed the program and deleted the empty pem file (did I mention it was 0 bytes?), and it hasn't come back.