Booting into Safe Mode is generally the best first step when a virus infection is suspected as it allows the system to start with the bare minimum of programs and drivers. This limits the virus's ability to load or react to antivirus actions, making it easier to detect and remove the threat. Running antivirus scans in the normal operational mode should be avoided as the initial step due to the potential for the virus to hide or resist removal when all system resources are active. Reinstalling the operating system is a more drastic measure typically saved for when other methods fail to remove the malware infection. Using system restore can potentially revert some changes made by the malware, but it is not always effective depending on the nature of the infection and how far back the restore points go; it might also not remove the malware completely.