You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Eli, Thank you! I am astonished at your expertise. Incredible. This is better help than I could have ever imagined. I will be donating again soon! -- Lauren J.
Hi There Eli,
Thankyou thankyou thankyou for this plugin I donatede because 1 of my sites had 22 backdoors on it :o I had not a clue it had that many, all my sites were hacked thanks for this plugin and the genius of you and your team :) -- Eugene