Virus scan does not detect malicious codes in .php files. also, codes can be hidden in .js and images.
From 60 antivirus engines, 0 will report backdoors, hidden links, iframes, upload script, etc.
it must be checked manually, or with regex search going through all files, and you need to know what and where to search.