Somehow or another I have someone running a udp.pl script from tmp. even though tmp is set to noexec, its still being executed anyway, so ive decided to suspend accounts running phpnuke right now but doesnt mean it wont return. how can you prevent these scripts from running? Keep in mind a firewall like APF or kiss doesnt work because of the use of monolithic kernels