I've seen this happen as well. Some PC malware grabs dreamweaver ftp settings and sends it to a remote IP. The remote IP will keep adding the exploit code to the index.* pages until you change the ftp password. For us it was trying to ftp in once a day. Also, ban the ip.