Writing IPs to hosts.allow instead of hosts.deny

[10SexyApples]

I just upgraded to 4.0 and today noticed that in WHM my hosts access had hundreds of random entries ... I have watched in dashboard as the connections window blocks an IP and then reloaded the hosts access file in WHM and the same IP will appear. I'm manually changing them to deny while I wait for a ticket response, but, if anyone has any help here I'm all ears right now ... running on fumes and can't stay awake any more
I also viewed the /etc/hosts.allow file and it has text in it indicating that it believes itself to be the hosts.deny file~

[scott]

Is it symlinked to /etc/hosts.deny or something? The AR system is using the fixed target of /etc/hosts.deny, so it couldnt by itself modify /etc/hosts.allow

[mikeshinn]

No it was cpanel in her case. cpanel was independently writing to hosts.allow and hosts.deny.