Hacked file need checked and explanation

Closed - This job posting has been filled and work has been completed.

Job Description

I'm looking for someone to explain to me how to get rid of this script from keep popping up on a server (please see attachment)

Basically every time I delete the files they reappear and when I delete it from the domain the files still appear in the user directory however there are no shell files on there, I have checked the ssh ip login for ssh login "last -i | grep yourusernamehere" and it doesn't show any other IP addresses other than mine

To apply for this please include the following "Security check" as the start of your letter.

Open Attachment