You should take a look at this.
It is spreading fast!
http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html -- Bruno Accioly
Thanks for a great plugin. I've spent the last few weeks tracking an infection on our main webserver with no permanent success. But your plugin has nailed the little bugger once and for all. Well worth the donation! -- Duncan E
Great plugin, just donated, grateful for your plugin and thanks for your hard and smart work! xx -- Xenia