You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
This plugin is a lifesaver. Please, make sure you donate to keep this available for those who cannot afford to pay for help and, well, simply because it's an awesome plugin from an awesome guy. -- Martin Bowen
first plugin i have ever donated to. this is great work. bravo! -- Mike White