maintain persistency in linux

I suspect my web / ftp Linux server has rootkit, I found my cron job with new *.sh file created, so I cleared it, but after few days, cron job directory is fine, but under bin, sbin, there are more than 10 new executable generated, I deleted them, but few days later, they come into etc/rc various folder, thus my question is besides cron tab, is there any other places that rootkit can maintain persistency? how they maintain? thanks