LockyMonitor
Windows Service to check if files has been changed by ransomware
...If files has been changed it send a email and shutdown or disconnect the host or stop the server (LanmanServer) service to disconnect all shares on the server.
The FileSystemWatcher object raises the events for the files in the monitored target folder. If a file in the monitor folder is changed by a user or programm a false alarm will be raised! It checks the MD5 hash of the monitor files for file changes.
c# source is included in the zip file
It uses the FileSystemMonitor class.
The project is inactive because the software cant prevent against an infection.