A user cannot find multiple files on their machine.

The correct answer is C because the symptoms strongly indicate ransomware: files renamed with a new extension, files still unusable after renaming them back, and payment demands in cryptocurrency. Quentin Docter’s Complete Study Guide explains that ransomware commonly encrypts files, renames them with a unique extension, and places ransom instructions for payment. The Mike Meyers/Mark Soper material also states that ransomware encrypts accessible local or network data and demands payment for decryption keys. According to the CompTIA A+ malware-removal procedure, after investigating and verifying malware symptoms, the next step is to quarantine infected systems . Removing the machine from the network prevents the ransomware from spreading to shared drives or other systems. Reimaging and restoring from backup may be required later, and updating/scanning anti-malware is part of remediation, but isolation must happen first.