Eli,
I have run your plugin a few times at low level and had it remove and repair some malicious code but still have not solved the problem.
I was using the NEXTGEN Gallery plugin and had the problem that others are decribing here in the WordPress Forums. I have removed and deleted NEXTGEN Gallery.
http://wordpress.org/support/topic/plugin-nextgen-gallery-nextgen-gallery-and-malware
Where should I look first or how should I go about removing this iframe hack?
This particular iframe hack may not be identified as a “Known Threat” yet. I would love to catch it for you and add it to my definitions update if you are willing to give me access to your WP Admin. Otherwise, you could look through all the “Potential Threats” to see if it is one of those. if you do find it on your own please let me know what it was so I can add it to the updates.