Recent content by James T. Bray

I think it would help as it examines list of active plugins for unusual filenames and searches the files on your website, and the posts and comments tables of your database for anything suspicious.