you may use this tool to verify if your antivirus software can protect against Ransomware encryption

https://github.com/eddiechu/Encrypt-Delete-Test

Hello RichF,

It is unfortunate to hear that your server has been attacked by a ransomware infection. It is even more frustrating that you've lost such a huge amount of money. The problem with ransomware developers is that they not only ask for thousands of dollars, but they're also very likely to scam victims once the money is paid. It is very common for these persons to either ignore victims or to ask for even more once the initial payment is submitted. I strongly advise you not to pay these persons, because there's no guarantee that they won't ask you for a third payment and whether they will be willing to help you restore data or not.

Now, regarding the decryption. Is there any additional information that you could provide? Have you noticed any ransom notes that have been dropped in to the system (e.g., text files, images, .hta applications, etc.)? These notes are typically titled something like "info", "decrypt_files", "decryption_instructions", "read_me", and so on so forth. I assume that the aforementioned "[saveyourfiles@qq.com]" email address has been added to the name of each encrypted file. Is there any file extension that has also been added? If you do not see any, perhaps the system option that displays actual file extensions has been disabled and you can only see the file names? Ransomware infections rarely use email addresses as the final file extension. They tend to append email addresses to filenames, however, they also tend to add a final extension, such as ".encrypted", ".crypt" or something like that. For instance, a file named "1.jpg" could be renamed to something like "1.jpg.[email_address].encrypted", etc. There are hundreds of different variations and, unfortunately, email alone is not enough to identify the infection. It is crucial to know which ransomware has encrypted your data, because only then I will be able to tell you whether you can restore it without developers' interference. File extension and ransom note would be really helpful.

By the way, do you have any idea which executable was responsible for the infection and when did it happen? Having the malicious file would be very useful as well.