Q:

How does a trojan like Trojan:JS/BlacoleRef.BV infect a website?

Today I find out my website is infected with Trojan:JS/BlacoleRef.BV. The server is a shared server from a hosting company.
How does a trojan like this get on the webserver?

A:

In your case it is likely the recent Plesk credentials leakage vulnerability, which has been mass-exploited to install Blackhole.
Plesk is always the first of the unwanted packages I uninstall on a new server. Trust my administration to a sack of random PHP? Don't think so...

A:

There are a whole bunch of ways:

Vulnerability in a webapp, allowing:

Upload and execute arbitrary binaries / code on the system.
Extraction of credentials that can be used to access other services.

Vulnerability in the server software (e.g. Apache / IIS / PHP), allowing the malware to execute arbitrary code on the server.
Vulnerability in the system software (e.g. Linux kernel), allowing remote code execution.
Cracking passwords for FTP / SSH / webapps.
Using default passwords on unconfigured / misconfigured servers.
Accessing openly available configuration files from misconfigured servers.
Malware on sysadmin's machine, stealing credentials.
Social engineering / phishing attacks being used to steal credentials.

All are equally possible.

