I think we have a virus

ok thanks so far.
We found the infected machine.
many shares are encrypted but I could use my storage snapshot to recreate all files.

If Your system has been infected with virus and unable to access the files, then visit the Websites which are given below. It will provide simple instruction to detect the virus from your System and protect it from future troubles.

<a href="http://www.uninstallmalwareandvirus.com">uninstall malware and virus</a>

<a href="http://www.virusspywaredesinstallation.com">How to remove PC virus</a>

<a href="http://www.soreinigensiespywaregerman.com">Guide to Delete system malware</a>