You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
I just want to say thank you
your plugin works so well
It has saved my butt again and again
I have just donated a second time because your work is so much appreciated
I was about to give up and delete all my sites when i found your plugin
My hosting provider wanted to charge some outrageous amount that I simply could not afford
I will keep donating whenever I can afford to
thanks again -- Dan Howard
Truly extraordinary service and a great tool that fixed hacked scripts rather than just deleting them as other tools wanted to do (which would have broken my site).