wp-file.php, ajax.txt and Cache folder keeps appearing

Hi all, for quite sometime my wordpress webhosting under attack by some kind of spamware. It periodically creates wp-file.php, ajax.txt and a cache folder in the main directory of my wordpress site. These files send out spam under my domain name, causing it to be blacklisted. I tried deleting the files and folders, but they keep coming back. I have change my webhosting password, database password but nothing helps.

Anybody know how to get rid of this…or is it hackers manually hacking and planting the files in my webhosting directory?