GoDaddy Security Found Malware

I don’t use GoDaddy Security services but the domain name is registered there. That being said, my client forwarded me an email showing me that the site has been flagged for Malware. I have CleanTalk anti-spam and security plugins installed and active. These are the two files showing on their scan they sent my client:

rex.array_join.006 – html/css.php

php.spam-seo.doorway-gen.043 – html/wp-hloper.php

What should I do about these two files????

Are they bad?

Thanks!