Malware in my website

My website suddenly suspended by Host company yesterday. They told me there were malwares in my site. After checking, I found some strange php and html files in my pub_html directory which were not built up by myself. Host company's report stated that those are phishing files and then I cleaned all of them and Host company activate my site again. But I found that 2 another strange html files appear in the pub_html dir again today even I have changed my admin passowrd. Those are html of advertisement (some include ###### pictures!!)

Here is one of the html:

<html> <head> <meta http-equiv="refresh" content="2; url=http://XXX.com/"> </head> <body> <h1>Loading...</h1> </body> 

Anyone could tell me how to block such html files installed in my site? Thanks very much in advance!

Have you changed your hosting company's control panel (probably CPanel) password and the FTP password ?