I've been hacked and still have problems

I am sorry to hear that your site was damaged again. I can’t tell you what to expect other than possibly more of the same experiences. It is difficult to know if you found all the malware left as a result of a hack. Just because your site seems to start working, might not mean that all the bad files have been removed or repaired.

Malware can be left in an otherwise working file or a new file may be added containing the bad code. The file can be located in the WordPress core, theme, plugins and / or database.

Reinfection is not all that unusual after repairing a hack. It just takes a snippet of code or a missed backdoor to reinfect a site.

Sucuri is a good product but I would use other scanning plugins too. There is nothing wrong with installing every server side scanner you can find even trial versions. You can remove them after the scan if you find no benefit to keeping them. You should also do your best to make sure the hack didn’t leave anything in your database.

Good luck this time in fixing your site.

What server side scanning plugins have you tried?

When you say you have pictures in the portfolio but not in the media library, do you mean you are seeing pictures that you did not upload?

Unfortunately, things may get worse before they get better. After I know what scans you have tried, I may have some other suggestions.