What does PCI DSS say about users disabling anti-malware?

• A.Anti-malware solutions must be disabled by system administrators whenever a scan slows a payment application provided the QSA is notified within thirty days of the change in the quarterly report
• B.Anti-malware solutions can be turned off by any user holding local administrator rights on that workstation after a ticket is opened with the service desk to record the temporary exception for the audit trail
• C.Anti-malware solutions must not be disabled or altered by users unless specifically authorized by management on a case-by-case basis with documented justification
• D.Anti-malware solutions must be reinstalled by users once each year after manual approval from the security awareness team lead