what actions to take when someone uploaded php files in random drupal folders and sending out spam
Notice how most of these code snippets begin with "preg_replace('/(.*)/e'"? That's because it's an alternative to the eval() function for executing PHP. The rest of the string is hexadecimally encoded; you can decode it using this script. That string will decode to PHP that probably executes other scripts or performs other actions to hijack your site and make it part of a spam mailing net.

Check out this StackExchange post for more details and suggestions. There are a bunch of good articles out there too that can give you tips on securing your server.