Ransomware in Winodows Server 2008 R2

Hi

Our server is affected with ransomware but one shared drive few folders are encrypted , we deleted folders from shared drive and copy from previous version, few folder copied but automatically all previous version disappeared.

i doubt few ransomware executable file still available in server.

is any tool available to check ransomware executable files or application?

so that we can remove it.

Note:- This server is domain controller.

Arvind