Google Hack / Redirect to drugstore

Hello, i have a site, which is getting hacked again and again and now i dont know, what i can do against.

What i have done, to secure this wordpress installation:
– changed all passwords ( ftp, wordpress )
– wordpress and all plugins are up to date
– all unnecessary plugins have been deleted
– all files and directories, except the theme, are from a fresh wordpress installation -> i removed all files and directories before, so that there is no file, which is not used by the current wordpress version
– all in one security plugin is installed and almost all features are active
– xmlrpc.php removed
– file permission is set to what all in one security plugin recommend

Which hack?
at round about 40 files following php code is added on top of the file:
<?php eval(gzinflate(base64_decode(‘pRn9c9o49ufc….

Which files are getting changed, for example:
/index.php
/wp-settings.php
/wp-content/themes/Avada/framework/views/metaboxes/page_options.php
/wp-content/plugins/wordpress-seo/inc/wpseo-functions.php
/wp-includes/ms-settings.php
…. alot more

after i clean up the files, it takes 2-4 hours and the hack is back again.

I hope, somebody can help me!
Thanks. hanuchin