You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
A brilliant plugin with superb support. Well worth a donation, remember how difficult life was before you found this. Thanks Eli, appreciate the help, and I've donated a gesture and will do so again when I get can. Cheers, Edan -- Edan Keenan