Connection will not be encrypted. Looks like this is an ssh 1.2.30 client. The first file looks most interesting since it is an archive and probably contains other files. This means that our rootkit has now been recovered. Identifying the files that make up the rootkit Based on size and type these files match some of our deleted files.
Lets take a look at the install script.
No luck trying to translate it at any of the translation sites. Lets see if we can find the file names in the strings of either of these programs. Same applies for top. I can't find anything obviously nasty here, except maybe just the telnet daemon being enabled. There is a small amount of data in this file, but nothing of any value.