[PlatinumServerM]

First thing you should do is install suphp to track which account they are coming from, so instead of them being owned by 'nobody' it will show the actual account. That will narrow it down to the account that has the vulnerabilities in it.