Virus Attacked Cryptolocker

How to find effected machines,What is the Anti Virus software for this

There is no particular AV for Cryptolocker. All paid good products protect.

To find an infected machine, isolate it and look through local documents. They are likely encrypted.

The only acceptable way to recover from a Cryptolocker attack is restore from a backup. Most Cryptolocker variants will purge Shadow Copies before running, so don't rely on VSS to save you from these attacks. Protect *all* user accessible shared folders with a full backup suite that stores backups securely.

Don't even think about paying ransom, as doing so both encourages continued development of this kind of attack and puts you at risk of spending money and not getting anything from the attackers. They're already criminals, so they will certainly not care about actually delivering on their promises if you pay them.

It's actually pretty easy to determine which user was attacked by a Cryptolocker if your shared folders get hit. Right click the encrypted file, go to properties, select security tab, select Advanced. Whichever user is shown as the file's "Owner" is the one who got hit. Once that is identified, it's pretty easy to figure out which computers they've used (Ask them) and take them off the network.

Thank you very much for all advice.

I found one of our server had a the same virus,But it's NOT public shared folder.It's Shared only
Domain Controller and Administrator. So how is this happen?

Rsnsomware can encrypt file in unmapped drive so long the logon account has the privilege to access and map the network shares. Some even are spread and carried by USB which is infected and may be plugged into that file server systems.