My site is hacked!

Hello,

I run a few sites, and all my sites get injected with new php files like the ones below:

wp-content/themes/sahifa/js/functions55.php
wp-content/plugins/wordfence/views/general65.php
wp-content/plugins/wp-polls/images/dirs1.php
wp-admin/includes/sql57.php
wp-admin/js/functions33.php

This is just today.

This is what i have already done:

– Folders are set to 755 and files to 644
– deleted wp-admin en wp-includes and copies the fresh ones back
– deleted all plugins and re-installed them
– installed wordfence and ithemes security
– scanned my sites and cleaned it.
– .htacces in uploads folder to prevent php uploads (does not matter)
– deleted all the root files and copies fresh ones
– checked the databases
– followed alot of guides here on how to clean

What can i do more? Can anyone please help me?