My server at dedibox plant for two days without knowing why I am typing a Perl process with the command top which goes up to 100% CPU. So I kill and starts checking all my log files. And in the error.log file, I perceive that my server has made requests to:

• http://human-design.ru/adm/faqsupport/config/popup.txt

• http://www.wsteam.net/bt/sys.txt

Other pages are also present, these are scripts that can help take control of my server or to play with databases. I check my crontab and particularly that of the user running apache to finally find a process. Bash_history called Y2kupdate. Since I deleted this line and restart the server.

Anyway, then I look at the stats of my site and see a lot of pages called by ip Romanian unusual for a site in the language of Molière. Finally, somehow I do not think it is they who pose the problem of my script. It's going to replant and I do not know why.

I installed Chkrootkit and scan does not indicate infection.