@GossiTheDog It's always fascinated me that large networks take so long to deal with that stuff. My disaster recovery plan for such an event is to shut everything down and reimage/recover the backups.. obviously spend a bit of time first to find out how they got in but not *too* much because people gotta work.
Clearly there's a reason it takes that long, it's just outside my experience.