This happens to me about once a month as my site is a highly targeted domain for these activities. The method that they commonly use is "PHP Injections", and they "inject" a file onto your server through php functions, typically administered through the URL, and name it "index.php". They don't need FTP access to do this if they know what they are doing.
A way around this is to get your server setup to use another filename such as mainindex134.php as a root file, instead of index.php, default.php etc...
Hope this helps.
Do some research on "PHP Injection Hacking".
|