Header Spam Site Hacked

Ok team here is the trend I am using two themes both of which were hacked. What happens is there is some type of Java Script Hack that auto creates a user with administrative privelages then inserts about 200 lines of spam after either the footer.php or the header.php for the theme. Below are things I have tried.

1.Remove user with admin previlages. Comes back
2.Remove spam code, comes back.
3.Create identicle named user, without privelages, comes back.

This is really out of my skill set does anyone know how to get rid of something like this?