You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Thanks for such a useful plugin! One of my sites was hacked and infected a week ago - and is now free and clear of all viruses thanks in part to your malware scanner. Good work - I look forward to updated versions. Cheers! -- Matt H.