I have a rootkitted SUSE Linux and I'm trying to fix it. I have root privileges but when I go:
cd /etc/init.d vi rc.sysinit
vi tells me the file is [readonly]. The owner of the file is root.root and the permissions are 0644, so that is ok. Also the partition on which the file resides is mounter as rw and at least any other file in
/etc/init.d I can edit.
I also tried:
fuser rc.sysinit lsof | grep rc.sysinit
but no success. What could be locking the file and how can I "unlock" it? I also have some other locked files like 'ps' and 'netstat' which again I can't overwrite using:
rpm -i --force
The contents of
\#Xntps (NTPv3 daemon) startup.. /usr/sbin/xntps -q
xntps command is the first thing I need to remove.