Hi,
Do you have a recommended virus/malware scanner? I found someone else who had this problem and they were running sucuri security and that did not flag anything.
FTP and SSH are only accessible from my IP. All passwords changed.
Plugins and themes are all up to date, as is WP itself.
Thanks