Everytime this happens I can find and remove the code in the Backend under:
System->General->Design->HTML Head->Miscellaneous Scripts
We use Magento 184.108.40.206 with the latest security patches. I also changed the admin password but it doesn't help.
I would like to know how to prevent these attacks to happen again.