LockyMonitor

Windwos Service to check if files has been changed by crypto ransomware.

It does not prevent from ransomware infection!
Don't use it in productive environments to prevent data loss! The Software comes without any warranty.

If files has been changed it send a email and shutdown or disconnect the host or stop the server (LanmanServer) service to disconnect all shares on the server.
The FileSystemWatcher object raises the events for the files in the monitored target folder. If a file in the monitor folder is changed by a user or programm a false alarm will be raised! It checks the MD5 hash of the monitor files for file changes.

c# source is included in the zip file
It uses the FileSystemMonitor class.

The project is inactive because the software cant prevent against an infection.