Well I came across this post,
You HAVE been compromised as Lorne suggested, It is probably too late to fix it now but please consider the value of a previous post of mine:-
It has saved me in the past from similar intrusions that get past the standard signature checking etc. currently in FreePBX which operates at a higher level but misses the sneaky bastards, it will catch ANY changes made in /etc/asterisk ( your problem) or /var/www/html/ yes you will get an email soon after you press reload, that would be expected, but if you get an email and you had not done that, then it’s time to get your detective boots on. if necessary repairing the damage is as trivial as an rsync from the snapshot directory.
Another suggestion, never have your /tmp filesystem on a hard disk, it’s just begging for trouble and the damage remains even after a reboot.