 <p>If the code appears again, then the attacker left some script, which, on request, runs the infecting procedure. Usually this script receives an encoded string of the malcode (e.g. in <code>base64</code>), decodes it and executes via <code>eval()</code>. You should find this file (it is most likely a PHP script) and remove it. To find it look at the log and search for suspicious requests (e.g. a single <code>POST</code> request, transmitting <code>base64</code> string is a very suspicious one). </p>