is this realy related to the SSHD Rootkit described at http://www.webhostingtalk.com/showthread.php?t=1235797&page=97 ? i thought that was the end of it but it looks we have to see more. we haven't been infected but this is making us enforcing our security policies even more. advisable for everyone in fact. never use root passwords, use SSH keys on non-standard SSH ports !