Injected malicious code and change js file permission

Hello,
All my websites from the server are compromised. The virus injected files like index123.php, malicious code in files, and he change permission from 644 to 600 to all js files from server. I change passwords, reinstall wordpress, themes, plugins… I don’t know what to do next… ??
One of them is https://www.lnphotography.ro