First, you should not have the root of your website writable by the web user. See our documentation on Securing the File System.
Second, there aren't any services in mojoPortal which write files or allow files to be written to the root directory. You should make sure that the files are actually malicious and that you don't have something or someone else writing those files to your file system.
Thank you,
Joe