Hack – .X1-unix direcotry created

Hello Guys,

I’m having a hard time with a directory being created every day in one of my plugin directories. It’s payload is thousands or directories / files that contain encrypted php code.
http://screencast.com/t/Hm3vRD5sXsB

What would be the best way to find out what is causing it? I have been unsuccessful in finding the rouge file causing this.

1. I’ve locked down the permissions
2. Installed and using wordfence
3. Updated WP and plugins
4. Review log files daily
5. Block ip’s and countries
6. Applied htaccess code to fend off attacks.
3. Removed all “bad” files that I could fine.

Any help would be appreciated.