Our web server was compromised about a year ago and we've finally had time to fix most of the issues that resulted in this. The only issue remaining is that multiple filenames were duplicated and modified.
Here's an example, also note that this only happened in our /var/www/ folder where all of our site .php files are.
Adapter13860111d520376a.php. Adapter13860117d52173717.php Adapter13860117d52383717.php Adapter13860117d52493717.php5 Adapter.php
Where Adapter is the original file.
While the original files don't seem touched (we've checked multiple in the folders that this were happening at) the duplicated files were, where the only contents in these files is this:
<?php eval("echo base64_encode('sitefolder');");
This happens in about of dozen .php files in our var/www/site folder.
So my question is, how can we removed all files that matches these filenames or based on the contents of these files?