Wretched Hacking Issue

Ever since using Wordfence, I have not had any issues with hacking…until now. Now, wp-config.php index.php wp-settings.php among others keep getting code injected to them over and over and over. I have even installed ithemes security on them.

I have set disable editing of pages to true, my username and password are obscure and I have changed the admin login url. It says the malware type is Malware:PHP/ico.

What else can I be doing? It is almost like clockwork that some obscure code is injected at the top of these files each time. Any help greatly appreciated!