You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
thanks so much for this plugin, it helped remove a back door script which my hosting company could not find!! awesome -- Foamy Media
Hi, thanks so much for your work, I really appreciate! I have tried many security plugins and yours is one of the best, lightweight but still if there is something, it will find it. -- Christa