You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Great plugin! I had already cleaned this particular site but I just couldn't be 100% sure I had completely nailed it. I now have peace of mind that the work I have done has sorted out the issue. Thank You! -- Gary Yates