You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
I used this tool on two websites I administrate - it worked great ... I will definitely have my clients donate to this plug in... keep up the great work!