First, change your passwords. A very similar question has been discussed on StackOverflow. Below is the quote of what I believed was one of the best answers from that question.
Typically when it's the .htaccess
files that have been infected, it's
usually the result of stolen
(compromised) FTP credentials.
This usually happens by a virus on a
PC that has FTP access to the infected
website. The virus works in a variety
of ways, but usually one of two.
First, the virus knows where the free
FTP programs stores it's saved login
credentials. For instance with
FileZilla on a Windows XP PC, look in
In there you'll find, in plain text,
all the websites, usernames and
passwords that user has used FileZilla
to access via FTP.
The virus finds these files, reads the
information and sends it to a server
which then uses them to login to the
website(s) with valid credentials,
downloads specific files, in this case
the .htacces files, infects them and
then uploads back to the website.
Often times we've see where the server
will also copy backdoors (shell
scripts) to the website as well. This
gives the hacker remote access to the
website even after the FTP passwords
have been changed.
Second, the virus works by sniffing
the outgoing FTP traffic. Since FTP
transmits all data, including username
and password, in plain text, it's easy
for the virus to see and steal the
login information that way as well.
- Change all FTP passwords immediately
- Remove the the infection from the .htaccess files
- Perform a full virus scan on all PCs used to FTP files to the infected
- If the website has been listed as suspicious by Google, request a
review from Google's webmaster tools.
If the hosting provider supports it,
switch to SFTP which encrypts the
traffic making it more difficult to
Also, look at all files for anything
that doesn't belong there. It's
difficult to find backdoors, because
there's so many different ones. You
can't go by the datetime stamp either
because these backdoors modify the
datetime stamp of files. We've seen
infected files with the exact same
datetime as other files in the same
folder. Sometimes the hackers will set
the datetime stamp to some random
You can search files for the following
- passthru (for .php files)
These are somewhat common strings in
You might find this Unmasking the Antivirus 2009 .htaccess Exploit useful as well.