You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
As promised I donated 29.90 , I have migrated from my horrible old host company to a new one and now I having all my sites online and scanning! Regards -- Agustin Juarez
Great work, happy to donate to support your efforts. I have used the plugin to clean up some issues and it worked as described. -- Jeremy