Hackers inserting ajax-2.php into /public_html directory

[TheLastSuperman]

Find the shell script and remove it, until you find that shell script they will keep uploading and inserting more malicious files (and yes, a plugin can also have the same functionality as a shell script file i.e. once the plugin loads it can do whatever they've designed it to do).

So it's either a plugin re-inserting the files OR when you cleaned the site you simply missed a file which is a shell script that allows them to upload additional files amongst other things.