A. Back up the user's files. Restore the system to the original system image designated by corporate IT policies. Restore the user's files.

B. Validate that the alerts are false positives, and disable security software on the workstation to prevent further false notifications.

C. Request a content filter exception to allow access to the link from the notification. Once available, follow the instructions on the linked site.

D. Compare the startup items and services to a known clean image, and remove any startup items not found in the other image. Run an anti-malware scan.