OK, fingers crossed, I think I removed their PHP backdoors.