I’ve also been fighting this problem for days, and thanks to the above posts, I also found the files wp_cache.php and _cache.php in my wp-uploads directly. Of course they’re both encrypted.
I still want to know how they got there, and just as importantly, exactly which one of the scripts was calling those files?
