Console app to check if files has been changed by crypto ransomware
...If files has been changed it send a email and shutdown or disable the network interfaces of the host.
It runs under the user account and monitor drives which are connected to a server share.
Works with remote to local Symlinks on a server share.
Can map and monitor drives by using the subst or net use command. Can monitor multiple folders or drives.
It communicates with a Windows LockyDisconnectService to disable all physical Network Interfaces (NICs).
Use the commandline Parameter:
-q to hide the console
-i to add the console to windows autorun and install LockyDisconnectService
c# source is included in the zip file
It uses the FileSystemMonitor class.
...