An incident responder discovers an attacker established persistence via a scheduled task that downloads and executes a payload from an external server at startup. What is the CORRECT sequence of eradication steps?

B is correct because effective eradication requires identifying ALL persistence mechanisms, removing all malware components, blocking attacker infrastructure, and verifying completeness before returning the system to production. A is wrong because rebooting before fully identifying all persistence mechanisms may trigger other backdoors. C is wrong because reimaging without investigation misses the full attack scope and may not address all affected systems. D is wrong because resuming operations with a disabled but not removed backdoor is dangerous.