@mediatemple two files were created on one of my hosts (that was a phishing attacked worry is that WP is all up to date.