Some https sites on my laptop are delivered with an invalid certificate (just found one site so far: https://gstatic.com). The invalid certificate is issued by cloudguard.me (adware as far as i can tell) but I found nothing on my pc - not even the ads cloudguard.me is supposed to show. This happens on Internet Explorer, Chrome and Firefox.
This question is specificly about the injected https certificate and not a generic "how to remove malware xy from my pc". I'm pretty confident, that there is no (active) adware on my machine except this invalid https certificate (leftover)
I already checked the following:
- no proxy used by browsers.
- installed software (everything is accounted for)
- running processes (nothing suspicious - everything signed, no virustotal hits)
- services: nothing suspicious
- checked with autoruns for unusual items: nothing
- cert. manager: no certificates by cloudguard.me
- connected via VPN to the internet (to rule out MITM)
- did a full scan with avira antivir (free)
- Created a new user account: same symptoms
I don't know if the certificate itself is important, if you want to take a look at it:
Base64 encoded X.509
-----BEGIN CERTIFICATE-----
MIIDXDCCAkQCAxAA5jANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJJTDERMA8G
A1UECBMIR3VzaCBEYW4xEjAQBgNVBAcTCUhlcnR6aWxpYTEhMB8GA1UEChMYR3Jl
ZW5UZWFtIEludGVybmV0LCBMdGQuMQwwCgYDVQQLEwNXZWIxFjAUBgNVBAMTDWNs
b3VkZ3VhcmQubWUwHhcNMTIwODE0MDUwMDAwWhcNMjUxMDE1MTUyNzAxWjBpMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRh
aW4gVmlldzETMBEGA1UEChMKR29vZ2xlIEluYzEYMBYGA1UEAxMPd3d3LmdzdGF0
aWMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqWpOFEv4eRZF
jb00ffsG5ZAJMEnPGS76E/Ws60i00pJWEHtk1n8dBILx5dsa0OCi1vOPA4jZbEin
pBDrMyAGdP9//fh/dh4ouVwEp6VFn9bj5io0+d6o1RMZAYsDhUmLX4u8CQO6y5RE
uap9ZeQ5XwjSl6ba9BzFF0ti9f4p5wrhPghZOhRKr6cNzT8IVyamkDL3xwHPlczB
lEMT42AIcl3QXDORyffLtYfRDoEY/Ve0ICFSFpKBMRacjI2r4LIwq/MarGI0B96w
+V0L4tXk9Rx6AO8isYJLQqrNfq/oB7kL1d/TD5UXzUrznsf7MifEQs5XSfu/ubn+
bRU4ZgYUsQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBbEj8WkvFrcdAjcJ5qoujn
zZGuqT8hL+ts8q/mg4sg+S1468RmsxPtm2+Gy57iYIIvCIa1T8YzEysSQhYSTY4X
58kFjKrNEN+H5N4GScne5Lnbnthm8exG+26F7uKWtQjx1wzyohQQ5WC5Iy24IqLG
A64om1Rmji5E3pIfu98NlVyU8wlE6jbRCl/r4mHEO2D8CGhDaWiQiolkgNZk1yQG
8rwHrr7yJRV247aTAPdvDX6GmM2OfH1F003n7RwlzxHBksxQZEr0LC85pHsiwMZV
XZ4rLaI2gjBT90qx8V5EUSvZwA8Vk8fof4BVhRXzYtBW3ITQTLk1Vzg1FzUXB5k5
-----END CERTIFICATE-----
Would be great if someone has an idea how to fix this problem, or where else to look. Thanks!
