You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Thank you sir, thanks to your script I am getting better -- Xeon King
Two installations and two donations. Worth every penny. Eli's plugin found a ton of stuff Sucuri didn't find. Thank you, Eli, for building a great tool to help us keep our Wordpress sites secure! -- Gary Cope