A user, Ann, reports that she suspects her workstation has malware. Joe, the technician, confirms
malware exists and starts the process of removing the malware. Which of the following is the
FIRST step he should take in removing the malware?

A.
Disable antivirus

B.
Disable system restore

C.
Enable hard drive encryption

D.
Format the hard drive

Explanation:
http://antivirus.about.com/od/windowsbasics/a/systemrestore.htm