The behavior you’re describing on the cache folder (reappearing) is expected. The cache folder is required for TimThumb.php to work correctly.

Those PHP files in the cache folder are definitely signs of bad behavior on your site. Hopefully the newly-replaced TimThumb.php is doing the trick for you! Thanks for joining the discussion!

Despite a variety of website scans from various vendors looking for malware, none was found…but site visitors irregularly reported infections on their personal and work PCs. The irregular nature of it caused me to look in the cache directory, where there were six PHP files, including two that used eval statements on gzipped and base64-encoded strings.

I replaced TimThumb.php again, this time directly from source, and renamed it thumb.php. Then I deleted the cache (after saving copies of the offending files). Monitoring now, but (fingers crossed) that seems to have done the trick.

Social success depends on a number of factors. We take a look at exactly what those factors are…….

You can safely erase the contents of the cache folder used by the TimThumb script, but the folder itself needs to remain intact. The script needs the folder to write files temporarily. Hope this helps!