Processes with arrows are from same cpanel account let say "charlie"
This account was under control of client.
Last week this server got blacklisted on emails because client run some
perl script to send spam emails. (First two processes)
First two processes had same
PID all the time so we killed the processes and spam emails stopped and never started again.
But last process with arrow PID changes all the time.
There is no such file on the server named "gbfcii.pl", there is no perl scripts in clients folders.
I have no idea how did they managed to do this?