A technician is troubleshooting a PC because the user has reported strange pop-up windows and computer performance issues. Which of the following actions should the technician take next?

Isolating the machine from the network prevents the potential malware from spreading to other systems or exfiltrating data, containing the threat while further remediation occurs. This is a critical first step in a malware response plan to limit damage and facilitate safe investigation.

Scanning for hidden files is a diagnostic step performed after isolation, but not the immediate next step to contain the threat.

Disabling unused ports is a preventative hardening measure, not an immediate troubleshooting step for an active infection.

Installing antivirus software might be part of remediation, but if the system is already infected, installing new software while connected to the network could potentially put other systems at risk or be compromised by the existing malware.

Reconfiguring the firewall might be part of hardening after remediation, but it's not the immediate next step to contain an active infection.