Considering how log4shell seems trivial to exploit and the important control level it gives to an attacker, should we wipe everything affected and start over  ?

For example, we find out that a publicly accessible server in production has log4j 2.0-beta9 <= Apache log4j <= 2.15.0 used by a service on that server.

Assumption  : We don't know if, between the vulnerability disclosure and the moment when the fix has been applied, an external attacker could have compromised the server and hid some malicious piece of code on it.

Considered recovery steps  :

1. From a trusted computer not affected by log4shell and clean of any other kind of malwares, download a Ubuntu desktop live media image and the server OS installation media as well.

2. Boot the affected server from the Ubuntu desktop live media image.

3. Backup important data on an external hard drive from the Ubuntu live media.

4. dd if=/dev/zero of=[Server OS drive] bs=4M count=1024 Note : Only wiping the boot sectors should be enough instead of the whole disk ?

5. Reboot, then boot from the server OS installation media.

6. Reinstall the OS and applications with updated log4j, then restore data.

To get at least an easy 96%+ we are safe from any bad surprises resulting of log4j exploitation, should we do the steps above on any affected servers or this is overkill plus a huge waste of time ?

Considering how log4shell seems trivial to exploit and the important control level it gives to an attacker, should we wipe everything affected and start over?

For example, we find out that a publicly accessible server in production has log4j 2.0-beta9 <= Apache log4j <= 2.15.0 used by a service on that server.

Assumption: We don't know if, between the vulnerability disclosure and the moment when the fix has been applied, an external attacker could have compromised the server and hid some malicious piece of code on it.

Considered recovery steps:

1. From a trusted computer not affected by log4shell and clean of any other kind of malwares, download a Ubuntu desktop live media image and the server OS installation media as well.

2. Boot the affected server from the Ubuntu desktop live media image.

3. Backup important data on an external hard drive from the Ubuntu live media.

4. dd if=/dev/zero of=[Server OS drive] bs=4M count=1024 Note : Only wiping the boot sectors should be enough instead of the whole disk ?

5. Reboot, then boot from the server OS installation media.

6. Reinstall the OS and applications with updated log4j, then restore data.

To get at least an easy 96%+ we are safe from any bad surprises resulting of log4j exploitation, should we do the steps above on any affected servers or this is overkill plus a huge waste of time ?