Few days before my website https://listvale.in has the same issues , in every directory there is a .htaccess file is generate automatically , once i removed manually again after some time .htaccess file is generate , my life was quite pathetic at that time , but after searching many alternative firstly i have installed Securi plugin which has removed all infected wordpress core files and after that i have installed wordfence firewall , Now everything is working smoothly , you can also use securi firewall but that was paid option , thanks
