Part of what my most recent copy of Medfos trojan attempted was looking up FTP passwords that might be on the system (tested the executable that had a PDF icon via malwr DOT com)

My guess is that the trojans are stealing the passwords and then the blackhats merely logon and substitute the binaries.

Good reason to use two-factor authentication *AND* never store passwords for websites, ftp sites, etc...