A user reports that a Windows workstation has become extremely slow over the past week. You notice the system fan runs constantly, unfamiliar toolbars appeared in the browser, and the network activity light blinks even when the user is idle. After confirming and disconnecting the machine from the network, what should you do NEXT according to CompTIA's malware removal best-practice process?