After using antivirus and malware removal tools, if abnormal processes are still occurring, the engineer should analyze the components of the infected hosts and their associated business services. This step is crucial to understand the scope of the infection, determine how the malware is affecting the system, and identify any changes made by the malware. This analysis will help in planning the subsequent steps for cleaning the infected host and restoring its functionality1.