RansomwareDetectionService

Ransomware Detection Service

Project Description

This program detects all present and future ransomware in Windows file shares or local drives.

I made this service to monitor Windows file servers or NAS file shares. For early detection of ransomware you expect the ransomware to encrypt your sample files and you catch it in the act. This entraps ransomware because the sample files that ordinarily would be left alone become encrypted by the ransomware. I made this program to aide system administrators monitor file servers. I didn’t make this for average users to monitor individual computers.

Username and password requested upon install are a domain account or local computer account for the windows service to install and run under. The account specified will need read/write access to the file shares you want to monitor. The user account can be changed later using the services.msc console. Find the service called “RansomwareDetectionService”.

Prerequisites

Installing:

Download the zip file and extract installer Files (setup.exe and RansomwareDetectionServiceInstaller.msi) into the same directory and run setup.exe as administrator Download link: https://github.com/prestoncooper/RansomwareDetectionService/blob/master/RansomwareDetectionService2.0.4.6.zip Run the installation setup.exe downloaded from step 1 (Username for the service will be requested while installing the Windows service (username must to be in “Username@DOMAIN”, “DOMAIN\Username”, “Username@COMPUTERNAME”, “COMPUTERNAME\Username” format.)

If you specified the username correctly and clicked on OK, then the install will show success. This domain username will need at least read access to the files shares you want to monitor. The copy options require read/write access to the file share.

After install launch the system tray application then right click on it. (You might have to click on the little arrow on the left of the system tray to show hidden system tray icons)

This program solves the following issues:

This program detects when/where ransomware has hit Windows file shares or local drives, and can stop the further spread of encrypted files if a script to stop the user’s computer or to stop the FileServer filesharing services is specified. This program doesn’t prevent the initial ransomware infection.

When staff members get ransomware, you need to respond quickly to get their computer shutdown as soon as possible. If you respond quickly enough, you can shut down the offending computer before other file shares become encrypted. Anti-virus programs currently do not detect encrypted files written by ransomware. Not knowing that a ransomware virus is on your network is a big problem. The sooner you get the offending computer shutdown and restore your backups of files shares the better.

File servers do not get the virus, the virus encrypts the files stored on the file server. This makes knowing the damage caused by a ransomware difficult. If you do not notice an encrypted file share, you can lose your opportunity to restore from backup or cause your users to use a much older backup than necessary. Anti-virus programs are always a few days behind in detecting new viruses.

Documentation

For full documentation see the link below: https://github.com/prestoncooper/RansomwareDetectionService/blob/master/docs/Documentation.md

These tasks can help with damage control after an infection, or help keep your file shares maintained.

Built With

Author

This site is open source. Improve this page.