I've experienced a very strange behavior on a Debian server. This server runs a lot of website, most of them CMS, mainly WordPress.
And sometimes something renames my files from wp-db.php to wp-db.php.suspected for example.
And these files seem to be clean, they are standard WP files. We have ClamAV, chkrootkit, rkhunter and maldet installed. I thought first ClamAV causes it, but after making a scan by hand it didn't find anything, plus the files get renamed on the fly, and ClamAV is not a resident AV so...
Has anyone seen such thing before or has an idea what can causes it?
Some searching with Google I found that I'm not the first one who has such an issue. It happens to a lot of different system and CMS, which makes me think it is the system.
Thank you for your help in advance.