The first time you reported this happening I suggested you secure the system and restore the site from backup. At the time you had no backup, clearly you've not learned anything from the first attack.

You're wasting your time if the system isn't secured by someone who knows what they're doing. This probably isn't you.