Installation Scan

Is there an installation scanner or something that can run through the install of WP and find files that shouldn’t be there?
I am being attacked on a daily basis and files are being uploaded to my site and I have no idea how and why.
My host is sending me constant emails about my index.php sending spam to 100’s of emails. I have followed procedures to clean reinstall, changed all passwords and I’m now at a loss…