Originally Posted by till
Please check your system with rkhunter to see if or which rootkits are installed. as the scripts run all as www-data user, most likely just one website is affected and not the whole server. So it might be possible to fix the problem by just cleaning one website.
Thanks for suggestion
I have never used rkhunter going to take look in it.
how ever currently I have not published and third party website. and none of my website have so much trafic. there are approx 10 website total.