best software to scan server?

[HollyKNY]

One of my customer's sites was hacked over the weekend (running current versions of WP and Genesis). I ran a Sucuri scan that said the site was clean, as well as a BackupBuddy scan, and a free AVG scan I found online that said the same thing. I later found an offending encrypted PHP file called "zaza.php" in the wp-admin folder that I decoded using a service I found online that was definitely something a hacker inserted - the date and time also matched the time of the hack. Why would 3 scans not pick this up? Any recommendations for a GOOD scanning software that is more accurate are welcome! Thanks!