I too have had this problem plague me for months on an off on my server – found this info this morning – and also found the file!
See: http://securityresponse.symantec.com/avcenter/venc/data/php.rstbackdoor.html
I found this virus in a file called news.php by downloading my site again to a backup folder on my PC, then scanning the folder with Norton.
Hope this helps.
