(17-07-2016, 07:19 PM)z3bra Wrote: I think the first thing to do, if possible, is to close all network access to the box.

(17-07-2016, 03:55 AM)venam Wrote: Actually it's a way better idea, you don't want that system to stay online with
an attacker on it.
And maybe you have a real time fight with him, and he kicks you out and erase
everything on the machine.
But sometimes you can't afford to remove a live system, a production system.