Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that most people say it's a piece of malware which targets WordPress installations (and I can't find anything to the contrary). His site however doesn't have any WordPress installations on it. The server is shared hosting courtesy of BlueHost, with SSH/FTP access. If GetMama is meant to be an automated virus, I'd love to know how it compromised the site without any WordPress installations. After cleaning GetMama up from all infected files with some regex magic, a few days later it would be back. I searched the site for any sign of compromise but I wasn't able to find any. The access logs only seem to date back 24 hours or less (I'm not sure if this is BlueHost policy or logs getting wiped). Other symptoms included a manual compromise of the forum administrator's account, injecting malicious code into vBulletin's templates. The site owner changed the passwords, and there were no further forum compromises. After thinking the site was finally clean for a while, malicious JS was sent to users by a 301 redirect in a .htaccess file.
Basically, I'd appreciate knowing how you guys would deal with a situation like this. I can't work out how to find the point of compromise. For example, that .htaccess file popped up in the last few days, but there's no recorded data on how - only when. Same with the malicious PHP code injection, I don't see any data on what modified those files. We changed passwords, but even so, SSH doesn't report any unauthorised users logged in in the past few months (at least). What methods could I use to analyse future infections and locate their point of compromise (bearing in mind I'm on shared hosting without root privileges to work with)?