Activating the EDR system's isolation feature for the affected virtual servers would be the first action to take. By isolating the servers, this prevents the potential malware from spreading to other systems and limits the infection within a controlled environment. The isolation helps in containing the threat while further investigation and remediation actions are taken. Running a full system scan without first isolating the affected machines might result in the malware's proliferation through the network. Checking logs is important but initial isolation prioritizes containment. Rebooting may disrupt critical forensic evidence.