Assist with Magento Updates and Security Issues -

We recently received this message from Nexcess our Magento host: During a recent security scan of our infrastructure, we detected potentially malicious activity where an unusually high number of messages were being sent to a small number of addresses at yandex.com. This activity was not the result of a compromise in our infrastructure, however, this unusual and specific activity prompted a more thorough investigation. In the course of our investigation, we discovered that some Magento sites may have been compromised by a malicious attacker. Although we do not monitor a customer's code or application for vulnerabilities, traffic monitoring indicates that your account may be sending an unusual number of messages to the domain above. Their recommendations and project requirements are to: 1.) Perform a full code audit of your Magento installation. 2.) Ensure that all available patches are installed. 3.) We have determined that common elements include a 'testReview' function added to one or more of the following Magento files: /includes/src/[login to view URL] /includes/src/MW/Onestepcheckout/controllers/[login to view URL] /app/code/local/MW/Onestepcheckout_old/controllers/[login to view URL] /app/code/core/Mage/Admin/Model/[login to view URL] This function is capable of forwarding payment or login information to an e-mail address (often peterpakerdr at [login to view URL]). In most cases, there is also a file in /var/package/tmp/[login to view URL] with a similar time/date stamp as the above files, often named "ePay", which could be used to upload malicious code. We have also noted instances of /skin/adminhtml/[login to view URL], which could grant an attacker remote access. Please review and ensure that no malicious code is found. We'd like to see all the results of the full code audit. Thank you.