After logging onto his computer system, a user discovers that some of his files are missing and some have been renamed. What is the BEST course of action in this situation?

This is a typical sign malware. You first need to remove it. The seven steps involved in removing malware are:
1. Examine and confirm the signs of malware.
2. Put infected systems in quarantine.
3. Disable Windows' System Restore.
4. Remediate infected systems.
a. Update anti-malware software.
b. Use scanning and removal techniques such as safe mode and preinstallation environment.
5. Schedule scans and run updates.
6. Enable System Restore and create a restore point in Windows.
7. Educate the end user.