I have an old Joomla 1.5 site hosted on a shared Bluehost server. Recently my .htaccess files are being rewritten every 10 minutes, and the site has been black listed. It looks like some php cronjob. What is the procedure to track where the file could be? The cpanel provides no features to track malware or any such.
How could I track the source of the problem?