Actually I'm really confused by what you are seeing. I am guessing that the process ran some compiled code or a shell script and the default gateway was was cleared.

The gateway itself can be updated by the sysadmin and as you say:

Code:

route delete .. .. ..
# or
route add .. .. ..
# or
/etc/defaultrouter (file added or changed)

If you are sure the script "did it"

Code:

grep route [shell script name]

and also look for invocations of other scripts. If there is an executable file called, try

Code:

strings [executable filename] | grep route