LockyService

Windows Service to monitor drive c: for file events with crypto specific file extensions or with big file entropy.

It does not prevent from ransomware infection!
Don't use it in productive environments to prevent data loss! The Software comes without any warranty.

When a alarm is triggerd it send a email and shutdown the host or disable the network interfaces.
The alarm can be triggerd if locky extensions were found. Or if files were probably encrypted (big file entropy level). Or if a file event counter exceeds the allowed number of events in a certain periode of Time. Or if the the file extension does not represent a valid file because it has been encrypted.

c# source is included in the zip file
It uses the FileSystemMonitor class.

The Project is inactive because the software cant prevent against an infection.