Found index.php in files folder and all its subfolders? Anyone know what type of exploit is this?
Just an additional note, this looks like it could have been caused by the FCKEditor / CKEditor arbitrary file upload bug.

If using one of those WYSIWYGs, check this advisory:

http://drupal.org/node/1482528

and upgrade to latest