Hello Alvaro,
Is this the exact path your hosting provider stated?
If yes, then it more than probable that your site was compromised.
These files are not a part of K2. They have been disguised to look like normal files however.
JoomlaWorks Support Team
---
Please search the forum before posting a new topic :)