You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Donated $29, thanks for the amazing plugin! Cleaned up a very pesky infection that seemed to have slipped through. -- Kevin Mullins
I dont have words to say! I installed your plugin together with Wordfence and Sucuri but only with yours i found the files and deleted the malware from my website!!! I donated you $10. -- Emmanouil Avagiannis