I fixed it... but for a while (at least 6/13/2016 21:00 EDT - 6/14/2016 09:00 EDT) my site was dropping crypto malware. PLEASE SCAN YOUR SYSTEMS. The hack may have been as early as 5/18/2016.
I use CryptoPrevent on all systems that I touch. Another tool that I'm finding very handy is the GWX Control Panel as it seems to be the best way to thwart Microsoft's insistent Windows 10 Update.