check for harmful 3rd party cron at /etc/cron.daily/php-mode-600; check perms on webmail index.php files, and phpMyAdmin, phpPgAdmin, /u/l/c/cpanel.php