Hello,
I'm using hosting services in Lithuania, www.iv.lt
i receive email (weekly scan), they said that injection file founded in your directory and code:
{HEX}Injection.36 : /home/inmalt/domains/insoma.lt/public_html/plugins/system/jabuilder/helper.php