I can't edit /etc/init.d/rc.sysinit as local - vi says it's [readonly]

Question

I have a rootkitted SUSE Linux and I'm trying to fix it. I have root privileges but when I go:

cd /etc/init.d
vi rc.sysinit

vi tells me the file is [readonly]. The owner of the file is root.root and the permissions are 0644, so that is ok. Also the partition on which the file resides is mounter as rw and at least any other file in /etc/init.d I can edit.

I also tried:

fuser rc.sysinit
lsof | grep rc.sysinit

but no success. What could be locking the file and how can I "unlock" it? I also have some other locked files like 'ps' and 'netstat' which again I can't overwrite using:

rpm -i --force

The contents of rc.sysinit is:

\#Xntps (NTPv3 daemon) startup..
/usr/sbin/xntps -q

The xntps command is the first thing I need to remove.

Answer 1

I found what was causing the file to be read only, even for root - the immutable flag.

Running the following did the trick:

chattr -i rc.sysinit