Q:

Could ransomware be stalled while encrypting?

I have been reading about ransomware, and I was wondering if it could be defended against by having certain "trap" files on a drive. Sometimes I look through Code Golf and am thoroughly impressed by some of the solutions posted, some of which I wouldn't think are possible.
So I wondered: Is there a way to have ransomware's encryption process get hung up by specially created files (not just exceedingly large files)?
Could a file be created that, when encryption was attempted, would send the encryption process into an infinite loop, or at least one that might take a long time to complete? Maybe a monitoring program that is able to begin creating dummy files, while at the same time deleting encrypted dummy files as they are encrypted, so that the encrypting process is led down an endless path?
Of course the idea here is to stall the encryption process midway. Or, perhaps, could accessing the special file cause the computer to enter some form of "safe mode" that halts current processes?
(Note: this would obviously be a last-line-of-defense strategy, certainly not something that one would ever want to rely on for security, but an extra measure in case more proper measures all fail)

A:

Your suggestion is interesting; unfortunately a generic solution is not possible as there is no combination of bits that would cause an encryption algorithm to "stall".  Encryption is just math, after all.  Perhaps use of a rootkit could trick ransomware into believing that it's encrypting a fake yottabyte-long dummy file handle, or it could have delays built in that hand out the bytes from the file very very slowly, but those kind of approaches are likely to impact normal usage of the computer as well. 
There might be specific versions of ransomware that have implementation bugs that you could somehow exploit to make this happen, but that approach has numerous problems.  Malware authors and script kiddies evolve and change ransomware programs all the time, so depending on a bug in today's version is no assurance that you'll be infected by the same version of ransomware tomorrow.  And there are hundreds or thousands of different ransomware programs out there today; no exploitable flaw is going to be present in all of them.  
@HameJames approach is one way of attempting to detect ransomware in action, but there's no guarantee that his trap file will be the first file encrypted by the malware and will shut it down in time, or if it's the last file and the shutdown just makes it worse.    
Your best defense at this point is still operational security.  Make regular backups of important files and keep them offline.  Don't open unexpected email attachments, or click on phishing links.  Keep your security software up to date, and your systems patched.  All the normal advice still applies.

A:

You could create a watchdog that creates a fake file, C:/A, and looks for changes in it. As soon as a change is detected, shut down the computer immediately. That's most likely the safest.

