You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Just donate $29 to this awesome plugin. Longlife gotmls.
Keep the best work for us -- Svetlin Stoyanov
Hey, thanks a lot! Just donated and wish it could be more b/c your plugin has saved me headaches I've read about thus far. I will recommend to my editor/webmaster to use on pure.xahir.com We are active in the blogger community, publishing reviews and once got hit with weird stuff from all the increasing traffic. (Thanks also for the reminder email, it was great!) -- Lisa