They unplugged the *infected* machine?
At that stage of events, if there was only one machine distributing the malware, (which all seemed to go domrmant on disconnection) then it's not a virus, if anything it's' a C&C node
At that stage of events, if there was only one machine distributing the malware, (which all seemed to go domrmant on disconnection) then it's not a virus, if anything it's' a C&C node