I have previously asked a question There's an expect.php file in all the git repositories of my web server, is this malicious? and this question is a further continuation if it.
After investigating some more, I found in my cPanel processes section the following processes:
The reason I am skeptical regarding the processes is that when I delete the malicious expect.php or options.php files I have asked about in my previous question, they automatically come back in about a minute or two. To my tiny brain, this suggests that something is running as a background process behind all this misery.
So my question this time is, are these processes malicious or things that are run by cPanel or HostGator's PHP shared hosting servers by default? Please do note that none of the PHP apps I have written have any "processes" in them. So I suspect that this could either be a part of the malware or something that is run by HostGator or cPanel.
