During a malware outbreak, the incident response team has already isolated the affected workstations from the network to stop the spread. The team lead now directs analysts to remove the malicious files, delete created registry entries, and close the exploited vulnerability before returning systems to service. Which incident response phase does this activity BEST represent?