[bigredseo]

We have also found ONE file with the "main.php" being compromised.

Basically any file with the following words are the likely targets:

INDEX, DEFAULT, MAIN

We've seen the following:
index.htm, index.html, index.php
default.html, default.html, default.php
modifier.default.php
main.php

If you are unable to find the files yourself, please contact your host and provide them the search commands as posted in post 64 here on the forums. They should be able to scan your site for any references to IFRAME and live-counter.