I'd strongly recommend imaging your disk and then wiping it securely and re-building the server. Ensure the compromised server is disconnected from the network immediately to stop any compromise spreading. Work on the disk image not the compromised server if you want to check the possible source and extent of the compromise.
Don't rely on restoring data to overwrite a virus or backdoor - you need to securely wipe the disk and rebuild the server. Scan and check backups as well before using them.
Presumably you have anti-virus running on the server? If you have then either it's not updating regularly, it's a zero day virus, or a direct hack that gained access to some level of interactive login. If you haven't install one and scan the image/disk - it may tell you what is going on. Scan all backups too.
If someone malicious has gained access to your server then, with sufficient permissions, they could move files wherever they wanted to. A full forensic investigation is needed to find out the cause and extent of your compromise.
You can start by checking access logs for interactive logins - tie up recent login access with specific accounts and check with the account owners to discount those logins - or not!
You can't trust timestamps on files - they can be changed easily. Do you have any intrusion detection system with file integrity checks? What does that system say about changed files and dates?
There are so many steps to take to try to track this down but if you're not prepared for a breach then it's very likely you'll not find the source of the issue easily if at all.
Also consider what data was in the database in terms of sensitivity and confidentiality. It's possible that the compromise has leaked some, or all, of the data from your database - if someone can wipe it they can almost certainly transfer the data out of the network (depending on your firewall egress rules).
Finally don't forget to check all servers and devices that this server has access too i.e. can connect to from services or accounts on this server - the compromise may have spread.
There's plenty of information on line on how to investigate breaches to find possible causes and how to clear up - don't just restore some data and hope for the best though if you don't know precisely how the compromise occurred and what damage/changes has taken place.