CERTs page has this to say under the III Solutions section:

If you believe a host under your control has been compromised, you may wish to refer to

Steps for Recovering from a UNIX or NT System Compromise

So, they've given UNIX first billing on a distinctly Microsoft problem? Spin! Spin!