Malware - Mobile version - we have been hacked twice

Hi Jason,
Hoping you can shed a little light on if I have set up the site open to malware. They have managed to get into the site twice now and plant an htaccess file into the root of the site. I could give you this file if it would help. This is just a site in development but it's getting frustrating. FYI the passwords are complex, with upper and lower case and numbers. we have changed them. We have now moved the site to a new folder etc. but we could not determine how they got in. My service provider is questioning some of the read write permissions settings that webassist is using. Do you have any experience and dealing with this? And if so what are a few steps we could take to make sure it doesn't happen.