Malware suspicious files on server: wflogs/attack-data.php ;config.php ; ips.ph

For about two month now I receive warnings about daily changes on few files on the server.

wflogs/attack-data.php
wflogs/config.php
wflogs/ips.php

It looks suspicious that the files are changing everyday even when there was no management activity.

Can some one tell me what’s going on, and how to detect this issue?

Thanks,

Alon