An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that sends thousands messages, and the script is auto-generated by something. Even if I try to remove it, it creates newly by itself by using a new name (in /boot, /etc/init.d). Besides, I see the netstat command doesn't show me all real open ports. Maybe has the command been replaced? How is it possible to re-install it?
It's always a question of effort vs result. If an attacker has gained complete control over the system, there are thousands of things that can be replaced or trojanized. Hunting them down one by one is a very time consuming task.
If the attackers aren't very sophisticated, you can start by searching for files that have been modified recently. One starting point is to look for files on your system that have last been modified in /usr/bin and /sbin (where most commands are).
ls -ltr /usr/bin
Check what's going on in /etc by looking at files that have been modified in the last 10 days:
find /etc -mtime -10
These are really basic first steps, and they don't cover looking at currently running (and potentially hidden) processes, that may hide any recent changes to the system. That's why this can turn into a cat and mouse game that can last for weeks if you miss just a single point of entry.
Unfortunately, reinstalling is the best option - least time consuming and almost guaranteed result!