My money is so far on Darkleech apache module[1] as the cause. As far as I know it's still unclear how the attacker gains root access to the server to do the in

My money is so far on Darkleech apache module[1] as the cause. As far as I know it's still unclear how the attacker gains root access to the server to do the install. [1]http://malwaremustdie.blogspot.com/2013/03/the-evil-came-back-darkleechs-apache.html http://malwaremustdie.blogspot.com/2013/03/the-evil-came-bac...