Strange folders and files in the .tmp folder

Question

I run two computers with Ubuntu 11.04 installed on one of them and Ubuntu 12.04 on another one. Both of them are connected to internet through one wireless router. I found that an identical set of files and folders have been plantet in .tmp folder on both of my computers despite the fact that they have different versions of OS running on them. The names of files sound very suspicious and they look like a spyware. Most of these files cannot be deleted as they are locked for the comp owner. Some of them can be removed, but replicate soon after that. I reformatted the hard drive of one of the comps and installed Ubunt 12.04.02 LTS freshly downloaded from the Ubunt site. I intentionally disconnected the comp from the internet during installation to see if these files appear again in the .tmp folder. And they did. Here the names of these files and folders:

/tmp/keyring-CTCn6F
/tmp/orbit-thierry
/tmp/pulse-2L9K88eMlGn7
/tmp/pulse-PKdhtXMmr18n
/tmp/pulse-qagOC5AMyLRa
/tmp/ssh-tJOQMucK1524
/tmp/virtual-thierry.ozVf7i
/tmp/unity_support_test.0

Please, advise if they are legitimate for the Ubuntu, which is hard to believe, and, if not, how to get rid of them?

Solution

The /tmp directory is the place where running applications may store temporary files.

/tmp
temporary data created by programs will most likely go in this directory. 40–100MB should usually be enough. Some applications — including archive manipulators, CD/DVD authoring tools, and multimedia software — may use /tmp to temporarily store image files. If you plan to use such applications, you should adjust the space available in /tmp accordingly. ^{Ubuntu Help}

For pulseaudio they mainly contain a PID and additional program settings which are stored to prevent running multiple instances. A desktop user will have no access to these, mainly because these directories and files were created by root at boot up

This directory should be cleaned after each reboot (see: How is the /tmp directory cleaned up?). You may see this from the time stamp which should be newer than your last reboot. Only if you had files older than your last boot you may be faced with an incomplete clean up of the /tmp directory. This which may come from personal settings or may be a bug.

Comments

[Graeme Walsh]

I peaked into my /tmp directory and saw a set of very similar files/folders. Like you, I thought to myself should these files be in here and are they harmful? Unfortunately, I'm not sure, to be honest. If it helps, the only files you've listed that are not in my /tmp directory are /tmp/ssh-tJOQMucK1524 and /tmp/virtual-thierry.ozVf7i. The others - keyring, orbit, pulse, and unity - are there. Not sure if this is useful information, but at least it puts two of us into the one boat!

[Thierry]

Thank you for your response. It contains very helpful information for me. According to your suggestion, I have check the time stamps in the properies window for each of the files mentioned in request. Unfortunately only one of them, /tmp/unity_support_test.0, had the time stamp coniciding with time of my last reboot. All the other had nothing in appropriate places. The Light Display Manager was indicated as the owner of this files with all the comp owner's priviledges competely withdrawn. Just in one file the root user was said to be an owner, but also with all priviledges removed.