With that said I would imagine that what's happened here is that a webshell perhaps was contained within the 1.tgz tarball and that's currently acting as a back door. Without seeing the content of that tarball I can only guess but to the best of my knowledge that's what's happened he...