C # server Upload Trojan Monitor code (contains suspicious files) _c# tutorial

Copy Code code as follows:

Using System;
Using System.IO;
Using System.Threading;
Using System.Windows.Forms;
Using System.Net;
Namespace Trojanmonitor
{
public partial class Form1:form
{
Public Form1 ()
{
InitializeComponent ();
}
delegate void Settextcallback (string text);
private string Fname,code,emailkey,ip;
Private Thread thr;
private void Fsw_changed (object sender, FileSystemEventArgs e)
{//File change monitoring (includes new)
fname = E.name;
THR = new Thread (new ThreadStart (Chkfile));
Thr. IsBackground = true;
Thr. Start ();
}
private void Fsw_renamed (object sender, RenamedEventArgs e)
{//renaming monitoring
fname = E.name;
THR = new Thread (new ThreadStart (Chkfile));
Thr. IsBackground = true;
Thr. Start ();
}
private void Chkfile () {
string filename = fname;
String Content= "", FILEPATH=FSW. path+@ "+filename,filename=" ", hzhui=" ";
filename = path.getfilename (filename);
Hzhui = path.getextension (filename). ToLower ();
if (Hzhui = = ". asp" | | hzhui = ". aspx" | | hzhui = ". php" | | hzhui = = ". jpg" | | hzhui = = ". gif")
{
try{
if (isfileinuse (filename)) {System.Threading.Thread.Sleep; Chkfile ();}
StreamReader sr = new StreamReader (filepath);
Content = Sr. ReadToEnd ();
Sr. Close ();
if (chkcontent (content)) {
try{
String Bakpath = Application.startuppath + @ "\trojanmonitorbak",
LogFile = Bakpath + @ "\log" + DateTime.Today.ToShortDateString () + ". Dat",
NewFile = Bakpath + @ "\" + DateTime.Today.ToShortDateString () + @ "\",
Newfilepath = NewFile + DateTime.Now.Hour.ToString () + "point" + DateTime.Now.Minute.ToString () + "min" + DateTime.Now.Second.To String () + "second" + DateTime.Now.Millisecond.ToString () + "milliseconds-" + fileName;
if (! Directory.Exists (Bakpath)) {directory.createdirectory (Bakpath);}
if (! Directory.Exists (NewFile)) {directory.createdirectory (newfile);}
if (file.exists (Newfilepath)) {file.delete (Newfilepath);}
File.move (Filepath,newfilepath);
string str = "[+ DateTime.Now +]"] found suspicious file: ["+ filepath +"] to ["+ Newfilepath +]";
Addtiem (str);
StreamWriter sw = File.appendtext (logfile);
Sw. WriteLine (str + "\ r \ n");/write Log
Sw. Flush ();
Sw. Close ();
Sw. Dispose ();
Downurl ("http://www.cqeh.com/mail/?") Emailsubject= found suspicious file ("+ IP +") &emailkey= "+ Emailkey +" &sendhtml=["+ IP +" ["+ DateTime.Now +"] suspicious file found: ["+ FilePath + "]");/Send Email
SW = File.appendtext (filepath);
Sw. WriteLine ("This file detected a suspicious problem!") Please contact the Administrator! ");
Sw. Flush ();
Sw. Close ();
Sw. Dispose ();
}
catch (Exception ex) {Addtiem (ex. ToString ()); }
}
}
catch (Exception ex) {Addtiem (ex. ToString ()); }
}
}
private string Downurl (string url) {
WebClient client = new WebClient ();
String result=client. downloadstring (URL);
return result;
}
private void Addtiem (string text) {
if (this.lb.InvokeRequired) {
Settextcallback d = new Settextcallback (ADDTIEM);
This. Invoke (d, new object[] {text});
} else {
THIS.LB.ITEMS.ADD (text);
}
}
private bool Chkcontent (string content)
{
BOOL ReturnVal = false;
string[] Sarray = code. ToLower (). Split (' | ');
Content = content. ToLower ();
foreach (String i in Sarray)
{
if (content). IndexOf (i) >-1) {returnval=true;break;}
}
return returnval;
}
private void Form1_Load (object sender, EventArgs e) {
ip = dns.gethostentry (environment.machinename). Addresslist[0]. ToString ();
string config = File.readalltext (application.startuppath + "//monitorpath.ini");//Get Monitoring path d:\wwwroot
try{
Code = Downurl ("Http://www.cqeh.com/txt/trojan.txt");
Get Trojan Feature Library
FilePath. Text = config;
Fsw. Path = config;
Emailkey = Downurl ("Http://www.cqeh.com/txt/trojanemailkey.txt");
Access to send email license key;
This. Showintaskbar=false;
This. Visible = false;
}
catch (Exception ex) {
MessageBox.Show ("error:" + ex.) Message, "Cannot Start program!", MessageBoxButtons.OK); Application.exit ();
}
finally {}
}
BOOL Isfileinuse (String fileName) {//Determine if the file is in use
bool InUse = true;
if (file.exists (FileName)) {
FileStream fs = null;
Try{fs = new FileStream (FileName, FileMode.Open, fileaccess.read,fileshare.none); inUse = false;}
CATCH{}FINALLY{IF (fs!= null) fs. Close ();}
return inUse;
}else{return false;
}
private void Notifyicon1_mousedoubleclick (object sender, MouseEventArgs e)
{
This. Visible = true;
This. WindowState = Formwindowstate.normal;
This. ShowInTaskbar = true;
}
private void Form1_Resize (object sender, EventArgs e)
{
if (this. WindowState = = formwindowstate.minimized) {
This. ShowInTaskbar = false;
This. Visible = false;
}
}
private void Exit system Toolstripmenuitem_click_1 (object sender, EventArgs e) {
Application.exit ();
}
private void Display window Toolstripmenuitem_click (object sender, EventArgs e) {
This. Visible = true;
This. WindowState = Formwindowstate.normal;
This. ShowInTaskbar = true;
}
private void Form1_formclosing (object sender, FormClosingEventArgs e) {
This. ShowInTaskbar = false;
This. Visible = false;
E.cancel = true;
}
}
}

SOURCE Package Download