hello all, thanx for helping. the rootkit changed the attribute to i on the file. therefore even root couldnt delete it. after chattr -i on the file i could delete it. special thanx to r.drahtmueller greetings, r.frechen