学习用的服务器被黑了，高手帮忙

superyu

邮件提示：
Subject::cron root@linux-db  chown root:root /var/tmp/.a/CrossOver/2.6/2.6 && chmod 4755 /var/tmp/.a/CrossOver/2.6/2.6 && rm -rf /etc/crom.d/core && kill -USR1 6210 ......

但是查看root的crontab什么也没有
运行一些程序（如mv）总是提示segmentation fatal
重启后，无法启动。停在start udev。。。

用linux rescue方式启动，发现加了一个用户：angell:0:503::/usr/kerberos/:/bin/bash

Jeremiah.R

First changing your root password and deleting that user.

You can use some chkrootkit to check out all the binary in the /sbin and /usr/sbin

Then run the command lsmod to check that any abnormal module.

If u are a newbie, the best way for u is to reinstall your system.

superyu

谢谢，我觉得这也是个很好的学习机会。争取把它弄清楚