a couple of files were change, I have done an upgrade to hopefully prevent it happening again. It took me awhile to find what had been done correct it and do an upgrade, alot of sites have been hit by that. Seems a bit pointless.
I shutdown the server access until I got it sorted just in case.
You spotted it around an hour after it happened Gerry
Thanks for letting me know