malware alert

somehow someone got access to wp-blog-header.php and placed an encrypted javascript at the bottom, which calls a 1×1 px iframe and the browser answers with a malware alert. this has happened twice over the past month.

I removed the javascript and now changed the file permissions to 444, ie non-writable.

are there other ways to prevent this from happening in the future?