I'm not sure if this has been resolved so far as the virus is concerned so I thought I'd put in my 2 cents.
I had a client that had an issue with a "virus" replicating itself no matter how much he searched and replaced.
He contacted me and I went through his entire site and got caught in the trap of finding and replacing just as he did.
Then I took it one step further and downloaded the entire domain to my desktop and replaced the entire thing with a "clean" version.
But, yet again, the infection showed up *sigh*.
Then it clicked... I hadn't checked his tmp folders.
That's where the bugger was sitting, so no matter how many times I made a change, it would re-write itself into existing code as if nothing had ever happened.
Once I went through his cache and tmp folders on the server, I was able to eradicate the problem.
I hope this helps...