How to scan the public_html_ folder for webshells?

Question

Fight against spam

on the joomla 1.5.26 server, hung with plugins and components.
put all possible security packs and fixes.
ran through the clamAV server, found about 50 shells, slammed.
all the same herachit soap spam, that is, somewhere else there was either access or access from the outside to some form of sending.
what else to drive the system for foreign objects?
Or maybe someone knows, faced with a solution to this problem on the joomla 1.5 branch?

Answer 1

ai-bolit, it's really too suspicious like Kaspersky, but it's reliable)
www.revisium.com/ai