You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Fantastic plug-in! Spent hours trying to track down the malware on my customers site. stumbled across this tool. BAMB!!! All taken care of. Will donate soon! Thank you!!!!! -- Ian R. Wilson