We had this same attack twice, 8 days apart - I thought we'd sorted it out first time round but clearly not as they struck again this morning. At least this time round I knew what the cause was - we'd only just about got ourselves back to normal after the first attack.

I noted this time that the where an .htaccess file existed, the extra text was appended to the existing code, which might be worth knowing. Otherwise an .htaccess as described was created in every single directory, including those in the root below public_html.

We also had an old installation of phpMyAdmin on the server, which has now been deleted.

Hope this helps...