Thanks but no help. It's thankfully not rootkit related (run both the rootkit checkers) and as I say pretty certainly a script which will eventually be tracked down via the logs (I hope).
It'd be nice to have something to scan for stuff like this though. Given the amount of exploits in the 1000's of script out there you'd have thought someone would have a nice little script that looks for them
