Well, the interesting thing about this is that this had been on the system as part of an add in for vbulletin. The file had not changed, so I am still not sure why it went rogue recently. That said, I the site is now more secure than it's ever been due to changes, which is good...just wish it wouldn't have taken so long and so many hours.
