Have you followed the links Jan provided? Where are you in the process?
Did you already remove it from your site?
As to what is causing it, its always hard to say without analyzing your site.
The one thing I would add is don't stop at looking at just this site, extend it to the server or account in which it sits. It could be a backdoor you are missing.
Here is an example of why: http://blog.sucuri.net/2012/03/website-cross-contamination-blackhat-seo-spam-malware.html
Another big trend we're seeing is this: http://blog.sucuri.net/2012/03/a-little-tale-about-website-cross-contamination.html
There are also all the obvious things like vulnerable third party tools and poor server and account management.
As you can see, many variables to consider.