Yes, you're hacked, by the usual Russian-sphere adult-webmaster suspects. Those sites are down at the moment but they are known infection vectors.
Is the iframe code in the .php file itself when you re-download it from the server, or is it only in its output?
In the former case, either the server itself is compromised (is it your server or a third party's?), or you've been lax in setting the permissions so that the webserver user can write to the files, or — more likely in this case I think — you or one of the other people with FTP access to your account has had their password stolen by a trojan they will have picked up by a similar infection on another site.
In the latter case, it could come from the database if you have an application-level compromise in your PHP scripts (SQL and script injection, which are extremely common in badly-written PHP), or, if there's no sign in the source or the database, it could again be a server-level compromise.
Nuke the site, ensure your own machine is clean(*), change passwords, and stop using FTP. There is no reason not to migrate to SFTP in this century.
(*: don't assume your machine is clean just because you have one anti-virus that says so. Today's anti-virus is almost useless at detecting and especially cleaning malware. If you've been hit by a sploit in the past, you're very probably still infected with something the AV didn't catch.)