rivdiv

True. We had changed our credentials as well... but we have yet to find the source. Thanks for the suggestions.

Thanks. (We did remove them as soon as we discovered them.)

Attached is the second file. kenguruW0kWD.zip

The attached PHP files were found in our FTP directories. I'm a .NET developer and we're not sure what they actually do. I want to make sure they're not malicious or anything like that. I feel pretty stupid asking this, but can someone take a quick look and let me know what the code actually does? (On first glance it almost looks like a standard PHP mail class but I'm not naive enough to believe it's just that.) Thank you. kenguruYd9e.zip