LockyMonitor
Windows Service to check if files has been changed by ransomware
...It does not prevent from ransomware infection!
Don't use it in productive environments to prevent data loss! The Software comes without any warranty.
If files has been changed it send a email and shutdown or disconnect the host or stop the server (LanmanServer) service to disconnect all shares on the server.
The FileSystemWatcher object raises the events for the files in the monitored target folder. If a file in the monitor folder is changed by a user or programm a false alarm will be raised! It checks the MD5 hash of the monitor files for file changes.
...