Suspicious process on cpanel - centos

Question

I found a malware on my server which I managed to clean and maldet does not report any malware anymore. Some websites loads very slow (mainly WordPress sites) although I cleaned them and made sure there is no infected files there.
I always get these in the error logs, and some other errors in exim where someone is trying to send emails out from my server how can I solve this issue.
Oct 24 00:59:15 leadhero lfd[13172]: *Suspicious Process* PID:12874 PPID:12841 User:herolead Uptime:98 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:00:15 leadhero lfd[13411]: *Suspicious Process* PID:13011 PPID:9993 User:herolead Uptime:112 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:00:15 leadhero lfd[13411]: *Suspicious Process* PID:13012 PPID:12075 User:herolead Uptime:110 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:00:15 leadhero lfd[13411]: *Suspicious Process* PID:13017 PPID:9994 User:herolead Uptime:108 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:00:15 leadhero lfd[13411]: *Suspicious Process* PID:13018 PPID:2081 User:herolead Uptime:108 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:00:15 leadhero lfd[13411]: *Suspicious Process* PID:13079 PPID:13016 User:herolead Uptime:91 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:00:16 leadhero lfd[13411]: *Suspicious Process* PID:13102 PPID:12143 User:herolead Uptime:82 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:01:15 leadhero lfd[13636]: *Suspicious Process* PID:13213 PPID:12843 User:herolead Uptime:110 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:02:15 leadhero lfd[13791]: *Suspicious Process* PID:13489 PPID:13111 User:herolead Uptime:110 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:03:15 leadhero lfd[13958]: *Suspicious Process* PID:13655 PPID:13390 User:herolead Uptime:111 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php
Oct 24 01:04:15 leadhero lfd[14105]: *Suspicious Process* PID:13832 PPID:12841 User:herolead Uptime:111 secs EXE:/usr/bin/php CMD:/usr/bin/php /home/herolead/public_html/thailand/index.php

Answer 1

In the previous answer I have spoken of the false positive. It is true. But you have left off.
For your information, these usadno CSF Firewall, and have not configured properly.
We understand how it works will be advisable as they remove the alert is easy, but it is not the way.
You must edit the file /etc/csf/csf.conf (You can also do this from the WHM)
You must be to edit de var PT_LIMIT
# Process Tracking. This option enables tracking of user and nobody processes
# and examines them for suspicious executables or open network ports. Its
# purpose is to identify potential exploit processes that are running on the
# server, even if they are obfuscated to appear as system services. If a
# suspicious process is found an alert email is sent with relevant information.
# It is then the responsibility of the recipient to investigate the process
# further as the script takes no further action
#
# The following is the number of seconds a process has to be active before it
# is inspected. If you set this time too low, then you will likely trigger
# false-positives with CGI or PHP scripts.
# Set the value to 0 to disable this feature
A good value PT_LIMIT = 180
If don't like lfd send emails for this, put 0
Also you can select users for ignore this directive. You must to read about /etc/csf/csf.pignore

Answer 2

The above alert is a part of false-positive. If there is no suspicious code in those files, you do not need to worry. If you are getting relay alert from remote IP, you tweak the server setting to allow relay from your server only. You should make this change only if you are aware what you are doing. This may break your email script if it is configured it in wring way. Better you should purchase managed VPS or hire some experts to do it for you.