LockyService
Windows Service to monitor file events for crypto ransomware
...When a alarm is triggerd it send a email and shutdown the host or disable the network interfaces.
The alarm can be triggerd if locky extensions were found. Or if files were probably encrypted (big file entropy level). Or if a file event counter exceeds the allowed number of events in a certain periode of Time. Or if the the file extension does not represent a valid file because it has been encrypted.
c# source is included in the zip file
It uses the FileSystemMonitor class.
The Project is inactive because the software cant prevent against an infection.