[fum1n]

I believe mod security does some of the above mentioned.

You could do something like this:
scan.php

Al thou I'm not an experienced PHP programmer you could possibly just fopen all files in a specified directory (Example: public_html/ or forum/) and search for commonly used strings in PHP Shells (Example: "c99") and then fwrite a log of suspicious files and then CHMOD them to deny all.

Then set it to run every hour or something.