Machine is compromised, but not actively doing ́something badî
Attempt to contact the owner, leave v-mail
Ask the owner to take the machine off the network
Usually, we disable the network drop (Machine must be off the network the same business day.)
Then we follow the same procedure for an attacking machine.