Bit more info for people who care... Turns out that one of FTP the users got hacked (via brute force we suspect) and was injecting some junk into our php. The reason only 2 of the 10 sites were infected is because the particular user that got hacked only had access to two sites. We've cleaned the code and will be messing with the access restriction tonight. On another note, we got the guy's IP, name and phone number. He lives in Korea. Any fun ideas anyone has to mess with him?