sscotter

Thanks for your input.

I have checked and one of the compromised sites has the WP Mobile Detector plugin which contains a timthumb.php file. Grepping the logs doesn’t show anything of interest though.

I’ll keep on searching!