Hacker caught
Just happen to catch him in both servers, how he got in im not sure yet but have since then IPTabled his IP address for the time being. Anyway they were using our servers connection to download movies it looks like. Trace back on their IP comes back to someone in the netherlandshttp://www.dnsstuff.com/tools/whois....17.120.140.241
And the ftp server they were downloading from
http://www.dnsstuff.com/tools/whois.ch?ip=62.212.75.139
Looks like I got two differnet ISP's to contact and report abuse to.