Resolution

To protect your systems, ensure you have applied all patches for the flaws listed in the Root Cause section below.

If your systems are already compromised by the .IptabLes/.IptabLex DDoS botnet, you need to take immediate action. As the attacker gained root access you can't be certain exactly what that attacker has changed or installed on your system. You should back up your data, image the drive, and reinstall from scratch to ensure no trace of the attackers is left on your system. This guide from CERT will give you more details about the process you should follow in recovering from a compromise:

http://www.cert.org/tech_tips/win-UNIX-system_compromise.html

In the interim, to attempt to clean an affected system:

1. Check if IptabLex / IptabLes is running:

   # ps -ef | grep IptabL
   root   9000  1  mar 10  12:00:00 /boot/.IptabLex
   

   You need to kill all the .IptabLex processes

   # ps -ef | grep IptabL | grep -v grep | awk '{print $2}' | xargs kill -9
   

2. Look for the related files:

   # find / -name "*IptabL*" -print
   

   Ensure you are not including system files by mistake and then remove all of them:

   # find / -name "*IptabL*" -exec rm -f {} \; 
   

3. Look for further related files:

   # ls -al /.mylisthb*
   

   Remove them with the following command:

   # rm -f /.mylisthb*
   

4. Check /etc/rc.local for any strange commands that might be there related to the malware. Remove them if they are there.

5. Change your root password.

6. If you are using ssh, please remove the .ssh directory from root's home (/root/.ssh) and filter the connections to the machine.

7. Ensure your system is up to date with the latest security patches.