You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
You sir are my hero!
Your software removed the many compromised scripts that infected my websites. Thank you for being excellent. Sincerely! I am installing this on all of my WP sites from now on.
Bravo! I wish you the best! Thank you for all you do!
-Dave -- D. Montgomery
Thanks for this plugin. Great job and very useful today. -- Victor