@mrcupp
Yes, the hack is in all files with that name (or if they have that words in the name). I’ve WordPress MU and i deleted all files by hand (over 90).
We discover the problem. It’s about timthumb.php. We were atacked on September, and yesterday. We fix the problem on September (update timthumb, clean .htaccess), but we didn’t clean themes cache (Minimal, Coldstone…), and there were two malicious files (php and png). That files were the last visited before yesterday atack. The IP was 83.103.119.239. Erase all that files and all will be ok.
