Web Terminal Hack

In my systems there were also this other dropper:

/usr/lib/__root/__root

so you should remove it if found.