Just as a side note, I was compromised with everyone else, but thankfully have mitigated before things got too out of hand from what I can tell.

Looks like the webshells are both caught from a scan I just did to test out:

Asp.Trojan.Webshell0321-9840176-0

Thanks for the update….