hacked? or is it a rogue plugin which places .htaccess in wp-admin

I’ve noticed that for some reason a .htaccess file is generated and placed in the /wp-admin directory with a “deny from all” instruction resulting in a 403 error whenever I try to access the dashboard.

I can’t be sure whether it is someone trying to hack the installation or it’s a rogue plugin which somehow places that file in wp-admin. I removed the .htaccess to gain access to the dashboard, but every time I do that, a few hours or days later it is placed in there again.

I changed the ftp password, but it is happening again. I thought it was wp-security plugin, I removed that and it happened again.

I would appreciate any pointers you may have.

Here’s a list of the activated plugins in my WP 2.7.1 installation:

Akismet 2.2.3
Featured Content Gallery 2.1
FeedBurner FeedSmith 2.3.1
Get Recent Comments 2.0.2
Google XML Sitemaps 3.1.2
Insensitive 1.0
NextGEN Gallery 1.2.0
pb-embedFlash 1.5.1
podPress 8.8.1
Secure and Accessible PHP Contact Form v.2.0WP B20070213
Sidebar Login 2.1.7
Subscribe To Comments 2.1.2
Ultimate Google Analytics 1.6.0
WordPress.com Stats 1.3.7
WordPress Database Backup 2.2.2
wordTube 2.1.0
WP-EMail 2.40
WP-EMail Widget 2.40
WP-PageNavi 2.40
WP-Polls 2.40
WP-Polls Widget 2.40
WP-PostRatings 1.40
WP-Print 2.40
WP-Stats 2.40
WP Super Cache 0.9.1

Many thanks