htaccess generating automatically

 mv .htaccess ht

ls -ltr

check last file access

[root@server public_html]# ls -ltr

total 41600

-rwxr-xr-x  1 vishwabhushan vishwabhushan    18554 Jan 29  2005 logo.jpg

-rw-r--r--  1 vishwabhushan vishwabhushan      642 Aug 30  2018 index.html_old

drwxr-xr-x  2 vishwabhushan vishwabhushan     4096 Aug 30  2018 cgi-bin

-rw-------  1 vishwabhushan vishwabhushan 42242373 Jul 30  2019 vishwabhushan_db

-rw-r--r--  1 vishwabhushan vishwabhushan     3092 Jul 31  2019 wp-config.php

-rw-r--r--  1 vishwabhushan vishwabhushan      351 May 22  2020 wp-blog-header.php

-rw-r--r--  1 vishwabhushan vishwabhushan     8509 May 22  2020 wp-mail.php

-rw-r--r--  1 vishwabhushan vishwabhushan     2496 May 22  2020 wp-links-opml.php

-rw-r--r--  1 vishwabhushan vishwabhushan     3236 Aug 12  2020 xmlrpc.php

-rw-r--r--  1 vishwabhushan vishwabhushan       20 Oct 14 08:10 info.php

-rw-r--r--  1 vishwabhushan vishwabhushan     4747 Oct 27 08:35 wp-trackback.php

-rw-r--r--  1 vishwabhushan vishwabhushan    45463 Oct 27 08:35 wp-login.php

-rw-r--r--  1 vishwabhushan vishwabhushan     3939 Oct 27 08:35 wp-cron.php

-rw-r--r--  1 vishwabhushan vishwabhushan    22297 Oct 27 08:35 wp-settings.php

-rw-r--r--  1 vishwabhushan vishwabhushan     2328 Oct 27 08:35 wp-comments-post.php

-rw-r--r--  1 vishwabhushan vishwabhushan    31693 Oct 27 08:35 wp-signup.php

-rw-r--r--  1 vishwabhushan vishwabhushan     7165 Oct 27 08:35 wp-activate.php

-rw-r--r--  1 vishwabhushan vishwabhushan     3900 Oct 27 08:35 wp-load.php

-rw-r--r--  1 vishwabhushan vishwabhushan    19915 Oct 27 08:35 license.txt

-rw-r--r--  1 vishwabhushan vishwabhushan     7346 Nov 10 15:49 readme.html

-rw-r--r--  1 vishwabhushan vishwabhushan      374 Nov 14 05:13 login-success.php

-rw-r--r--  1 vishwabhushan vishwabhushan     4796 Nov 16 06:14 send-proposal-data.php

-rw-r--r--  1 vishwabhushan vishwabhushan     1752 Nov 28 22:33 register-success.php

-rw-r--r--  1 vishwabhushan vishwabhushan     2012 Dec  8 04:22 old-index.php

-rw-r--r--  1 vishwabhushan vishwabhushan     7246 Dec  8 04:22 wp-admin.php

drwxr-xr-x  2 vishwabhushan vishwabhushan     4096 Dec  8 08:39 include

drwxr-xr-x  9 vishwabhushan vishwabhushan     4096 Dec  8 08:39 wp-admin

drwxr-xr-x  8 vishwabhushan vishwabhushan     4096 Dec  8 08:39 wp-content

drwxr-xr-x 25 vishwabhushan vishwabhushan    12288 Dec  8 08:39 wp-includes

-rw-r--r--  1 vishwabhushan vishwabhushan     2094 Dec  8 09:31 wikindex.php

-rw-r--r--  1 vishwabhushan vishwabhushan       52 Dec  8 19:11 googlea18ae91e84ac0c94.html

-rw-r--r--  1 vishwabhushan vishwabhushan    11195 Dec  8 20:27 robots.txt

drwxrwxrwx  3 vishwabhushan vishwabhushan     4096 Dec 10 15:55 -

-rw-r--r--  1 vishwabhushan vishwabhushan     2917 Dec 13 17:58 admin.php

-r--r--r--  1 vishwabhushan vishwabhushan      509 Dec 21 04:48 htaccess

-rw-r--r--  1 vishwabhushan vishwabhushan      108 Dec 21 05:05 php.ini

-r--r--r--  1 vishwabhushan vishwabhushan      509 Dec 21 07:59 ht

-r--r--r--  1 vishwabhushan vishwabhushan    31116 Dec 21 08:09 index.php

means index.php is compromised

these files are wither created by some scripts from insode the fodler or preocess runnning in background top -c