hey Russian fellow webbies ;)
 

any of you know this gentleman: hvoraem-net.ru ??
he's been constantly injecting my php files with code which redirect mobile's traffic to his awesome site.

Looks like some black SEO dude. BTW if someone has broken your site a few times in a raw, isn't it a signal that means you have some serious security problems which require an immediate fix?

or his own computer is infected and they picked ftp passwords from there

I'll give 1% to that :)

ofc i'm trying to find source of the leak.
amerinoc guys working on it on server side and i think we are ok now.
just wonder if any of you know this site or owner.

Looks like you r under attack from some russian guy