Getting screwed over, need urgent help.

you could try looking at the timestamp of the file, though it's conceivable that has been altered.

Most likely, the WP sites are running old versions of WP or plugins that are vulnerable to attack. Keeping them updated is probably the most effective way to prevent this, but that will likely be challenging. Mass updating of wordpress is pretty simple - there are a lot of scripts out there to do that. There aren't many for updating plugins, though. php-cli is one that looks promising, though I haven't played with it.

Other than that, compiling apache with suhosin will help some. Be sure you're not running mod_php or have something in place (like mod_ruid2) to keep one site compromise from allowing an attacker to drop exploit code on all sites you host.

There's no 100% solution.

 

Also check your FTP logs, a lot of malware gets uploaded because of compromised user accounts.

 

What about this. ConfigServer eXploit Scanner (cxs)

That might help. But that best thing to do, is to restore the site to a time, when it was not infected. And change the passwords to a more secure password.

 

Thats definitely the best advice. Usually its a stolen password that lets them in.