We started having high utilization on the server and the network, to the point that everything came to a stand still. We figured out that the ip was from china and we blocked it and problem resolved. But we still have processes running on the server, which are related to this DDOS from china, they randomly come up with different letters, but we have not been able to determine where to remove if from.. They mentioned the cron, we saw a line that runs a process every 3 minutes, me removed it, but it still comes up in crontab... any ideas?