Well, I did find 2 PHP files and one link and deleted it. using
amportal a ma refreshsignatures
Will keep on checking..Thx
I just wonder why it doesn't act with all the IP Addresses I assigned to that server, When I close one of the connections - it stops..