uki is correct. This is a form of html iframe injection. This one most likely comes from infected windows computer and uses ftp to get to your site as uki mentiond.
Scan your computer, make sure it's up to date with all patches and up to date antivirus. And get a copy of malwarebytes anti malware from malwarebytes.org.
Do not roll back your computer unless you have no other choice. I have been in the business of repairing computers for 15 years and have found from experience that the windows restore feature should only be used if you have no other choice. It does work, but i have seen it make things worse far to many times for me to trust it.
One final note. Change all your passwords. Not just your ftp password. Change everything. FTP, MYSql, Cpanal, every password you use to access your server.