Ok, thanks for the update, I'll keep an eye on it.

Meanwhile I've received a ton of these, or similar:

Code:
Time:    Mon Apr  5 21:11:39 2010 -0500
PID:     29394
Account: nobody
Uptime:  360971 seconds

Executable:

/usr/sbin/proftpd\004bb51641\00\00\00\00\00\00\00\00 (deleted)

The file system shows this process is running an executable file that  has been deleted. This typically happens when the original file has been  replaced by a new file when the application is updated. To prevent this  being reported again, restart the process that runs this excecutable  file. See csf.conf and the PT_DELETED text for more information about  the security implications of processes running deleted executable files.


Command Line (often faked in exploits):

proftpd: (accepting connections)


Network connections by the process (if any):

tcp6: 0.0.0.0:21 -> 0.0.0.0:0

Files open by the process (if any):

/dev/null

Memory maps by the process (if any):
...