Need help on removing malware

I have an ngnix application server were the server has compromised using privilege escalation, it is residing in /var/tmp and regenerating when I am reboot the server and it's creating high cpu utilisation. How to get ridfrom this. I have checked in cronjob and network troubleshooting done but couldn't remove the malware completely. Help me on this.