royans

• index.html was difficult to read, small font and too much data. Recommend hyperlinked Table of Contents. Also, rename to writeup.html, so it does not load by default.

• Technical analysis was incorrect in several places. For example, mis-identified errors in time differences, never identified the system bot, and misinterpreted /var/tmp/nap.

• Did not discuss backdoor in sshd.

• Excellent job of detailing rootkit tools and what they do.

• Excellent job listing all of the references.