I wonder what makes those spam messages worth it. The last one was deleted within two minutes. Are there really enough people, dumb enough to click on those links, that manage to do it in that short timespan, for it to generate money?
@SsouLlesS If you have the appropriate logging for it, you should search for them for 'n7f2521', which is the payload carrying the executable code. What you do with it depends of course entirely on what you find, but if you want help understanding what's happened, you might wanna add it to the question. And if not the question, you might wanna post it in the chat, I'd be interested in seeing what there is. — Letharion7 mins ago
@SsouLlesS I guess there are ways, but it's not trivial. You don't happen to have a version control system in place? If so, it should be able to list all the added files.
Before you delete the files though, you might wanna see if they are reachable. What happens if you actually try to visit any of their paths with a browser? (The one you posted in the question looks safe enough to visit unless you give it it's post payload, so try that one if you can).
If you have a good vhost file, it would have kept anyone from reaching the files, which would hopefully have prevented anyone from actually using the files.
Do they all contain the same code, or are the variations?
@SsouLlesS You can't easily delete "php-files", since drupal litters them in every directory.
@SsouLlesS You might have better luck find all files by their content though, but that requires the content to be roughly similar across the files.
@SsouLlesS Your best bet would be git though. But if you don't have it setup already, it's of no use now.
@SsouLlesS Do you have a lot of custom code? If not, one way would be to just scrap the install you have, setup a new one, and copy over the few files you know you need.
@SsouLlesS Do you have the php module enabled? Cause if you do, cleaning out files isn't necessarily going to be enough.
It makes a world of positive difference if you take the same code and stick it into a module file instead. It's not much extra work, and can potentially save you from a world of pain. Such as your site being hacked.
