You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Just made a second donation. I gotta say man: you're awesome - and gotmls is an excellent tool. I'm a developer, so if there is a way I can help you out let me know. -- Ross Barbieri