No specific followups noted so far so not sure what they are looking for. I've finished digging through the rootkit. I've still not been able to contact machine owners. If you 'dig' up the MX record for the domain concerned, you get one choice and its the machine concerned. Still don't feel happy mailing them at this address.
Machine is still up and open by the looks of it.
Short of someone bashing the door down, there's not much more I can think of. Pls get in touch if there's any more I can do to help. If not, over and out. This is a list of all the SYN-FIN scans I have detected for the month of December 2000. Immediately follows a Syn connection to IP 192.168.30.1 to attempt to gain information from the FTP server protected by TCP Wrappers.