You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Every time i have a serious problem in a many websites for years - The Eli plugin always helps me and guides me to find the problem or solves the problem by itself completely. I have donated and will do in future also . All who are saved by this plugin also donate for this very helpful plugin - to give something back to the creator. Thanks for everything -- Vladimir Grgić
Just want to tell you, you plugins help me again and again, finding the culprit. I have made the donation.
Thanks for your good work and effort. You definitely help a lot of people like me.