Problem: Documents on Server Shares were getting encrypted.
Solution: Since the encryption was happening over 3 server shares we needed to stop the spreading of encrypted files first. We ran virus scans with multiple software solutions on two server. Viruses where found and removed. Since the Malware did not originate on one of the 2 servers we looked through our email filtering software to narrow down what users received attachments within 24 hours of the encryption starting. We then ran virus scans on the users local computers until the issue was found and removed. The computer was immediately pulled off of the companies network. We had local, off-site to hard drive, Cloud and previous version backups available for restoration. The multi-thousand documents were restored with minimal user downtime.