[rosinchard]

Even if you have backups, you've got to completely re-build or replace every server/machine that got infected, and you've got to do them all simultaneously to stop cross-infection on the new machines, and then you've got to hope that there isn't a trojan horse hiding somewhere else on the network that will suddenly re-appear once you've finished. Its not straightforward.