0

Some https sites on my laptop are delivered with an invalid certificate (just found one site so far: https://gstatic.com). The invalid certificate is issued by cloudguard.me (adware as far as i can tell) but I found nothing on my pc - not even the ads cloudguard.me is supposed to show. This happens on Internet Explorer, Chrome and Firefox.

This question is specificly about the injected https certificate and not a generic "how to remove malware xy from my pc". I'm pretty confident, that there is no (active) adware on my machine except this invalid https certificate (leftover)

I already checked the following:

  • no proxy used by browsers.
  • installed software (everything is accounted for)
  • running processes (nothing suspicious - everything signed, no virustotal hits)
  • services: nothing suspicious
  • checked with autoruns for unusual items: nothing
  • cert. manager: no certificates by cloudguard.me
  • connected via VPN to the internet (to rule out MITM)
  • did a full scan with avira antivir (free)
  • Created a new user account: same symptoms

I don't know if the certificate itself is important, if you want to take a look at it:

Base64 encoded X.509

-----BEGIN CERTIFICATE-----
MIIDXDCCAkQCAxAA5jANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJJTDERMA8G
A1UECBMIR3VzaCBEYW4xEjAQBgNVBAcTCUhlcnR6aWxpYTEhMB8GA1UEChMYR3Jl
ZW5UZWFtIEludGVybmV0LCBMdGQuMQwwCgYDVQQLEwNXZWIxFjAUBgNVBAMTDWNs
b3VkZ3VhcmQubWUwHhcNMTIwODE0MDUwMDAwWhcNMjUxMDE1MTUyNzAxWjBpMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRh
aW4gVmlldzETMBEGA1UEChMKR29vZ2xlIEluYzEYMBYGA1UEAxMPd3d3LmdzdGF0
aWMuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqWpOFEv4eRZF
jb00ffsG5ZAJMEnPGS76E/Ws60i00pJWEHtk1n8dBILx5dsa0OCi1vOPA4jZbEin
pBDrMyAGdP9//fh/dh4ouVwEp6VFn9bj5io0+d6o1RMZAYsDhUmLX4u8CQO6y5RE
uap9ZeQ5XwjSl6ba9BzFF0ti9f4p5wrhPghZOhRKr6cNzT8IVyamkDL3xwHPlczB
lEMT42AIcl3QXDORyffLtYfRDoEY/Ve0ICFSFpKBMRacjI2r4LIwq/MarGI0B96w
+V0L4tXk9Rx6AO8isYJLQqrNfq/oB7kL1d/TD5UXzUrznsf7MifEQs5XSfu/ubn+
bRU4ZgYUsQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBbEj8WkvFrcdAjcJ5qoujn
zZGuqT8hL+ts8q/mg4sg+S1468RmsxPtm2+Gy57iYIIvCIa1T8YzEysSQhYSTY4X
58kFjKrNEN+H5N4GScne5Lnbnthm8exG+26F7uKWtQjx1wzyohQQ5WC5Iy24IqLG
A64om1Rmji5E3pIfu98NlVyU8wlE6jbRCl/r4mHEO2D8CGhDaWiQiolkgNZk1yQG
8rwHrr7yJRV247aTAPdvDX6GmM2OfH1F003n7RwlzxHBksxQZEr0LC85pHsiwMZV
XZ4rLaI2gjBT90qx8V5EUSvZwA8Vk8fof4BVhRXzYtBW3ITQTLk1Vzg1FzUXB5k5
-----END CERTIFICATE-----

Would be great if someone has an idea how to fix this problem, or where else to look. Thanks!

0

Your computer is going to cloudguard.me's IP when it looks up the address for gstatic.com.

The malware altered your DNS settings to resolve some names to their malicious server for ad injection.

Fix your DNS settings to use your ISP's DNS and – if the malware really was removed – the problem should go away.

  • Wow I feel so dumb now. Changed the DNS settings and works like a charm. Thx. – wischi Aug 26 '16 at 6:45
  • DNS-altering malware is a scourge. I'm glad your computer is working better now. – Eric Aug 27 '16 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.