what actions to take when someone uploaded php files in random drupal folders and sending out spam I'm not sure how this happened, but my server techs notified me about some php files inside the includes folder sending out 50k worth of emails. I'm not sure how anyone would be able to upload that. I doubt its because my username/password was compromised for the domain. im finding these files littered through out the directories: http://prntscr.com/rhf93

In those files they contain all similar encoded php code:

http://prntscr.com/rgzmo

http://prntscr.com/rhfmq

Does anyone know what its doing or how i can decipher the code? And most of all how was it uploaded?
Notice how most of these code snippets begin with "preg_replace('/(.*)/e'"? That's because it's an alternative to the eval() function for executing PHP. The rest of the string is hexadecimally encoded; you can decode it using this script. That string will decode to PHP that probably executes other scripts or performs other actions to hijack your site and make it part of a spam mailing net.

Check out this StackExchange post for more details and suggestions. There are a bunch of good articles out there too that can give you tips on securing your server.