strange behavior after updates

[ArmandoC]

hi, i have a centos 6.4 with plesk installed. same days ago i have updated plesk to 11.5.30 and the os with yum update.
After these actions my server have been strange behavior

1 - i have received an email from watchdog that informing me that th server may be infected; in particular there were some warnings such as:
[01:00:49] Warning: The command '/usr/bin/GET' has been replaced by a script: /usr/bin/GET: a /usr/bin/perl -w script text executable
[01:01:04] /sbin/ifdown [ Warning ]
[01:01:04] Warning: The command '/sbin/ifdown' has been replaced by a script: /sbin/ifdown: Bourne-Again shell script text executable .....

2 - in log access i noticed that there are, every 5 minutes, an access to my server from my server, like this:
IP.IP.IP.IP - - [18/Aug/2013:04:16:48 +0200] "GET / HTTP/1.1" 200 915 "-" "-"

3 - in message log i have noticed a lot entry like this:
Aug 15 12:04:06 myServer xinetd[1738]: START: smtp pid=13530 from=::ffff:207.5.160.250

Can you help me to understand what has happened?

thanks

 

[IgorG]

I see nothing suspicious here. I have told you already - http://forum.parallels.com/showthread.php?290056

 

[ArmandoC]

ok, but what are all the entries
IP.IP.IP.IP - - [18/Aug/2013:04:16:48 +0200] "GET / HTTP/1.1" 200 915 "-" "-"
every 5 minutes in log file?

 

[IgorG]

ok, but what are all the entries
IP.IP.IP.IP - - [18/Aug/2013:04:16:48 +0200] "GET / HTTP/1.1" 200 915 "-" "-"
every 5 minutes in log file?

Need more details. What is this log file? What is this IP address? What is full related message from this log?

 

[ArmandoC]

Need more details. What is this log file? What is this IP address? What is full related message from this log?

the log file is the access_log
ip address is the address of my server

it's like you were connected to my server from my server

 

[IgorG]

access_log of one of your site what is hosted on your Plesk server?

 

[ArmandoC]

access_log of one of your site what is hosted on your Plesk server?

yes, is a domain hosted in my plesk server

 

[IgorG]

If I correctly understood it is default site for server IP address? In this case it is watchdog issue. Watchdog connects to server IP on port 80 each 300 sec for checking Apache status. This site assigned as default on this IP. Therefore records about connections of watchdog writes in site access_log.

 

[ArmandoC]

If I correctly understood it is default site for server IP address? In this case it is watchdog issue. Watchdog connects to server IP on port 80 each 300 sec for checking Apache status. This site assigned as default on this IP. Therefore records about connections of watchdog writes in site access_log.

Yes, is the default site for server ip....I can now feel comfortable
perfect, thank you very much