A user reports that their workstation is running slowly, displaying pop-up ads, and redirecting web searches. A technician arrives and confirms the behavior. According to CompTIA's best-practice malware removal procedure, what is the technician's NEXT step after identifying and verifying these symptoms?