Hello iang,

I have a full copy of what you are describing here. We snagged it from a client right after they rootkit'd one of our servers with it internally from a hosting account.

Its got an installer and a readme even...

fun stuff... we had to write counteractive scripts to unwind the mess across a couple hundred http sites not to mention the wreck it made out of the root files.

This one spawned from windows but now can work over linux via openssh or sendmail etc.