You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Just wanted to say thanks again Eli, your free plugin saved our Xmas sales and your support on Xmas Eve was awesome. Have donated twice. Merry Xmas. -- matthew mayer