[roger_smith]

Guys usually you aren't tricking someone into extracting this to /root. It's usually stuff you find in /root after a server has been rooted, and the malicious user is putting their tools on the system. It's a tar.gz of /root, because whoever archived it all up just made an archive of /root of an already rooted server. Also, if the server was created for the purpose of malicious activity, the root user may have just been malicious anyway, IE no root compromise, just a baddy bad :p