Often times its outdated modules on your server that are being attacked. I would recommended having a company like
www.sucuri.net scan your site and then fix your problem, let you know how it happened and how to fix it from happening again, then have them do daily backups.
Its 90 bucks a year and 5 bucks a month for daily backups and hourly virus scans for 1 site. They give you a badge to put on your site so you and your surfers know all is good.
The backups are downloadable so you can use them to fix your own fuck ups too.
They have a few other alternatives out there that I am sure are good but after I had a nasty Iframe injection they got it straightened out quick and were happy to explain.