Microsoft security experts outline next steps after compromise recovery