Can a virus alter a file without altering the timestamp?

most filesystems allow for setting the file modification date to any particular value. One definite way a virus would try to cover its tracks would be to try to set that time stamp value to what it was before the file was altered.

Yes, it's relatively trivial to alter a file without altering the timestamp, both through the filesystem and by bypassing it entirely to write directly to the disk. Not all virus scanners pick up every threat, and some threats - especially ones that are not directly harmful to the host platform - are not going to be immediately detected by every scanner, and may well never be detected by many scanners. It becomes progressively more difficult to accurately scan and flag for N viruses for M platforms than it is for N viruses on 1 platform. The stuff that isn't expected to be found on that platform will not be a priority for virus researchers. If you do not have PHP on your computer, and it is a PHP script with a trojan, there is no practical risk to your computer, unless you later transfer that file to a system that has PHP *and* you execute the script. Your web browser almost certainly can execute JavaScript, however, so there is a significant risk there.

Yes.

Yeah, the higher likelihood is what jgreco said - the virus scanner you're using just got updated to detect a signature in that file as a virus. So the file hasn't changed, but the set of things that the virus scanner detects has, so suddenly it's flagging something that wasn't there before. And no, a PHP trojan is of no practical danger to your PC; having a webshell (if it's truly a web shell) available on your client's server may be of danger to their server, depending on how it's secured, but those are the contextual issues that a virus scanner can't be aware of.

If that's something I thought of doing before submitting late papers in university (not that I did it), I assume the virus makers have thought of it as well.