Compromised hosting

please take a look on unv.gif . this is invalid javascript codes are embadded in one of my site's every index.php or index.htm page . I removed the kind of code lot of times but comes again. sometime it appears on .htm or sometime does not( but available in source code )

1. let me know steps how could i get rid of these codes
2. is this harmful ? is this kind of remote spyware that could track my activities or passwords etc.
3. though i have changed ftp also but no benefit how do they do it ?
unv.gif