You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Thanks for a great plugin. I've spent the last few weeks tracking an infection on our main webserver with no permanent success. But your plugin has nailed the little bugger once and for all. Well worth the donation! -- Duncan E
Thanks for you work! I used this tool on a client's site and was happy to donate $29.29 to the cause! -- Sean Leber