this morning, I watched a monthly webinar about IT-Security. One of the actual topics was the malware "mumblehard". This malware makes your server to a part of a botnet and sends spam via email. The malware is locate in the /tmp or /var/tmp folder. So I looked up to this folder and I saw a few folders. One of them was an owncloud folder, which named "owncloud-occ23cq12x22...". The moderator of the webinar said, that a folder with chars like in this example above is the malware folder. I restarted my server, because the tmp folder will be cleared. Now ist is nothing in this folder (mc folder for midnight-commander only). Is it possible, that this was the malware or is it normal, that owncloud create this tmp folder? I have installed owncloud on my webserver.


1 Answer 1


It is perfectly normal for software to create files and their own directory in /tmp/ to store temporary files (most likely these are session related files). That is what /tmp/ is for.

In general these files contain the name of the software (like your example with owncloud* and a "random" set of characters behind it). If you never installed owncloud and you have these files I'd expect something to be wrong. If you did install (as you did) it I would assume all is fine.

In my own /tmp/ I have a sni-qt_synergy. Synergy is software to connect 2 systems to 1 mouse and keyboard. You will also see this behaviour when using encryption (though this probably will be outside of /tmp/).

At the moment and with the information you provided I would say: perfectly normal.

Related to the malware: it is installed from WordPress and Joomla exploits and a cracked DirectMailer (if you do not have these you are safe(r)) and detection is very simple since it creates its own cron job. A crontab -l used with root and a more /etc/crontab will always reveal if this malware is present on your system

Remove that cron job, clean /tmp (or /var/tmp) and delete the cracked DirectMailer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.