Files/viruses are getting uploaded to tmp folder

Lately we have been getting .php.tmp files in our Drupal tmp directory (C:\Windows\Temp), and our anti-virus catches them as trojans/viruses.

The date stamp on the files correspond to log entries where foreign IP addresses are trying to access /wordpress/ paths in our drupal directory. (Which do not exist, and they get 404 errors).

I suspect the malware files are first uploaded, then are supposed to be moved/renamed and then run by the attacker by visiting the paths that are generating 404 errors. However, the files never get run because they never get copied out of the tmp folder, hence the 404 errors they get.

What confuses me is that I do not see any POST-related entries in the logs that would indicate how/where they are uploading these files to our site.

Has anyone else encountered this? I found one other forum post about it, however it did not seem to articulate HOW the files get uploaded or any resolution to stopping it. I understand there was a rotator that had security issues, but I do not think we are using that.

Our Drupal installation is running the latest updates, there is no FTP enabled, public registrations are not allowed...

Thanks in advance for any hints on how they are getting tmp files up there...