My money is so far on Darkleech apache module[1] as the cause. As far as I know it's still unclear how the attacker gains root access to the server to do the install.

[1]http://malwaremustdie.blogspot.com/2013/03/the-evil-came-bac...