i've checked the whole thing - initsys is really part of rootkit - all my firewall rules were down - chkrootkit finds inetd infected, and detects a hidden process... reports an LKM my smb.conf: hosts deny = ALL EXCEPT ip1.ip2.255.255 whatever this strange syntax means it doesn't look good :) - syslogd was modified that it doesn't log anything - crontab did not work so I have to install everything from scratch.... any hints are welcome to make my new system better. i need it as an apache webserver with ssh for administration and proftpd for uploads. a friend told me to use openbsd since it's more secure than linux. I don't know whether this is true, but at the moment I've too less experience with other OS to take anything other than linux for servers. thanks for your help robert