BASH Script to Get Rid of IptabLex Virus

The IptabLex Virus is actually a malware that runs under Linux OS. It keeps sending network packages from the server that blocks the normal usages. The CPU usage (e.g. htop) shows the 99% process is Iptablex (which looks like a firewall at first). Then we can kill such processes if there are any every few seconds (The virus can re-infect the OS).

#!/bin/bash
while [ 1 ]
do
  ps -ef |grep -i ipt
  pkill -9  /boot/.IptabLex
  pkill -9  /boot/.IptabLes
  pkill -9  IptabLe
  pkill -9  Iptab
  find / -name '*Ipt*' -exec rm -fr {} \;
sleep 2
done;

There is a known security vulnerability for struts2.0, which basically allows users to input code directly from the page to the console. Upgrading to struts2.3 or above secures the breach.

–EOF (The Ultimate Computing & Technology Blog) —