I'm suffering from a spam hack where my site periodically starts to show Viagra spam to Google and other spiders. The method of the hack is basically that my .htaccess file gets modified to route all requests through a file called "common.php", which is a big chunk of base64 encoded evilness.
I've noticed it happening on a weekly basis: every time I remove the hacked files, it pops back up a few days later. These are the steps I've already taken to secure things:
Changed my FTP password
Scanned my (shared hosting) directories for world-writable (777) files/folders and changed them to 755 or something more appropriate
Removed old copies of Wordpress from unused directories (the site itself is a custom-written PHP CodeIgniter app)
Downloaded the entire site to my local box and scanned the directories for occurences of strings like "base64" and ".ru" (spam domains?).
I'm a little uncertain what to do next as the problem still seems to be there. Is there some smart shell command I can run to figure out how these files are being uploaded? When I last checked, the .htaccess file was edited today by my own FTP user despite me changing the password a week ago and logging out any logged-in users. I don't leave it logged in on public machines, and a few other administrators of the site haven't been given the new password yet.
Any tips / ideas gratefully received. I'm happy to provide the output of any specific commands as needed.