Drupal file uploads (in core or modules) should use file_save_upload which itself also calls file_munge_filename. Together those two functions should ensure that even if a file contains php it is not named in a way that a typically configured webserver would execute them. They also have protection against pl|py|cgi|asp|js files which can often contain code.
Since you seem to have .php files in that directory you have to start considering other ways the files might have landed there.
- A vulnerability in a module that is allowing arbitrary file uploads
- A vulnerability in some other code running on the server (outside of Drupal)
- An insecure configuration (allowing users to run php) was used to download these files directly, avoiding Drupal's API.
- An attack that used a virus to read stored passwords (e.g. out of Filezilla) on your local computer - these are more common than you'd think, but they usually don't target the files directory.
I suggest doing a few things:
- Check the permissions and ownership on the files, that will help you know which webserver user uploaded the files and from there you can hopefully narrow which code was used to upload them. Or if, you notice they are owned by a specific unix user other than the webserver then you should worry about that account.
- Check when the files were created - go through backups to find when they appeared or check the file timestamps (though on most OS you can only the file last modified and not the file created timestamp)
- Check the apache logs for all accesses to these files and see which IP is accessing them and when (especially the first date of access)
- Check the apache logs for other accesses to your site from those IPs and on those dates
These investigation steps are meant to help narrow down how the files were uploaded. Ideally you'll find some specific event (e.g. a POST to some url on your site that you investigate and see is a way to execute php, something like the CKeditor/FCKeditor module issue, then you can know that's how your site was exploited.
If you do find out how the site was exploited, please report it as a security issue: http://drupal.org/node/101494