I am the webmaster of some websites running Typo3, 2 of which are getting infected constantly. These 2 sites are being owned by the same client.

Something happens on those 2 sites that causes literally all \*.php files to be infected by some code. It gets inserted at the bottom. Luckily the infection doesn't do much because I have php short-tags disabled and the infection depends on it (it uses short tags to execute it's code).

Now my question is: How is it possible that those sites are getting infected the whole time? I have made sure the client's computer is clean (he eventually did a full format 'n reinstall) and my own computer is clean too (absolutely).

What steps can I take to see how the script acted, how it came in, etc.
Keep in mind: I am not the hoster. The 2 sites are on 2 different hosters. The script infects all \*.php files, then leaves no further traces (no executables, no scripts, nothing out of the ordinary. The only thing I noticed is that a .\_htaccess file (not the .htaccess file) contains code to redirect the user based on referrer. This also won't work since the .\_htaccess file never get's executed and is a demo .htaccess file for typo3).

Greetings John