LockyMonitorConsole

Console application to check if files has been changed by crypto ransomware like Locky.

It does not prevent from ransomware infection!
Don't use it in productive environments to prevent data loss! The Software comes without any warranty.

If files has been changed it send a email and shutdown or disable the network interfaces of the host.
It runs under the user account and monitor drives which are connected to a server share.
Works with remote to local Symlinks on a server share.
Can map and monitor drives by using the subst or net use command. Can monitor multiple folders or drives.

It communicates with a Windows LockyDisconnectService to disable all physical Network Interfaces (NICs).
Use the commandline Parameter:
-q to hide the console
-i to add the console to windows autorun and install LockyDisconnectService

c# source is included in the zip file
It uses the FileSystemMonitor class.

The Project is inactive because it can't protect against ransomware