using System; 

	using System.IO; 

	using System.Threading; 

	using System.Windows.Forms; 

	using System.Net; 

	namespace TrojanMonitor 

	{ 

	public partial class Form1 : Form 

	{ 

	public Form1() 

	{ 

	InitializeComponent(); 

	} 

	delegate void SetTextCallback(string text); 

	private string fname,code,emailkey,ip; 

	private Thread thr; 

	private void fsw_Changed(object sender, FileSystemEventArgs e) 

	{//文件改动监控（包含了新增） 

	fname = e.Name; 

	thr = new Thread(new ThreadStart(chkfile)); 

	thr.IsBackground = true; 

	thr.Start(); 

	} 

	private void fsw_Renamed(object sender, RenamedEventArgs e) 

	{//重命名监控 

	fname = e.Name; 

	thr = new Thread(new ThreadStart(chkfile)); 

	thr.IsBackground = true; 

	thr.Start(); 

	} 

	private void chkfile(){ 

	string filename = fname; 

	string content="",filepath=fsw.Path+@"\"+filename,fileName="",hzhui=""; 

	fileName = Path.GetFileName(filename); 

	hzhui = Path.GetExtension(filename).ToLower(); 

	if (hzhui == ".asp" || hzhui == ".aspx" || hzhui == ".php" || hzhui == ".jpg" || hzhui == ".gif") 

	{ 

	try{ 

	if (IsFileInUse(filename)) { System.Threading.Thread.Sleep(2000); chkfile(); } 

	StreamReader sr = new StreamReader(filepath); 

	content = sr.ReadToEnd(); 

	sr.Close(); 

	if (chkcontent(content)){ 

	try{ 

	string bakpath = Application.StartupPath + @"\TrojanMonitorbak", 

	logfile = bakpath + @"\log" + DateTime.Today.ToShortDateString() + ".dat", 

	newfile = bakpath + @"\" + DateTime.Today.ToShortDateString() + @"\", 

	newfilepath = newfile + DateTime.Now.Hour.ToString() + "点" + DateTime.Now.Minute.ToString() + "分" + DateTime.Now.Second.ToString() + "秒" + DateTime.Now.Millisecond.ToString() + "毫秒-" + fileName; 

	if (!Directory.Exists(bakpath)) { Directory.CreateDirectory(bakpath); } 

	if (!Directory.Exists(newfile)) { Directory.CreateDirectory(newfile);} 

	if (File.Exists(newfilepath)){File.Delete(newfilepath);} 

	File.Move(filepath,newfilepath); 

	string str = "[" + DateTime.Now + "] 发现可疑文件: [" + filepath + "] To [" + newfilepath + "]"; 

	addtiem(str); 

	StreamWriter sw = File.AppendText(logfile); 

	sw.WriteLine(str + " \r\n");//写入日志 

	sw.Flush(); 

	sw.Close(); 

	sw.Dispose(); 

	downurl("http://www.cqeh.com/mail/?EmailSubject=发现可疑文件(" + ip + ")&EmailKey=" + emailkey + "&SendHtml=[" + ip + "][" + DateTime.Now + "] 发现可疑文件: [" + filepath + "]");//发送Email 

	sw = File.AppendText(filepath); 

	sw.WriteLine("此文件检测到有可疑问题！请联系管理员！"); 

	sw.Flush(); 

	sw.Close(); 

	sw.Dispose(); 

	} 

	catch (Exception ex) { addtiem(ex.ToString()); } 

	} 

	} 

	catch (Exception ex) { addtiem(ex.ToString()); } 

	} 

	} 

	private string downurl(string url){ 

	WebClient client = new WebClient(); 

	string result=client.DownloadString(url); 

	return result; 

	} 

	private void addtiem(string text){ 

	if (this.lb.InvokeRequired){ 

	SetTextCallback d = new SetTextCallback(addtiem); 

	this.Invoke(d, new object[] { text }); 

	} else { 

	this.lb.Items.Add(text); 

	} 

	} 

	private bool chkcontent(string content) 

	{ 

	bool returnval = false; 

	string[] sArray = code.ToLower().Split('|'); 

	content = content.ToLower(); 

	foreach (string i in sArray) 

	{ 

	if (content.IndexOf(i)>-1){returnval=true;break;} 

	} 

	return returnval; 

	} 

	private void Form1_Load(object sender, EventArgs e){ 

	ip = Dns.GetHostEntry(Environment.MachineName).AddressList[0].ToString(); 

	string config = File.ReadAllText(Application.StartupPath + "//monitorpath.ini");//获取监控路径 d:\wwwroot 

	try{ 

	code = downurl("http://www.cqeh.com/txt/trojan.txt"); 

	　　　　　　　　　　//获取木马特征库 

	filepath.Text = config; 

	fsw.Path = config; 

	emailkey = downurl("http://www.cqeh.com/txt/trojanemailkey.txt"); 

	　　　　　　　　　　//获取发送email许可key; 

	this.ShowInTaskbar=false; 

	this.Visible = false; 

	} 

	catch (Exception ex){ 

	MessageBox.Show("错误：" + ex.Message, "无法启动程序!", MessageBoxButtons.OK); Application.Exit(); 

	} 

	finally { } 

	} 

	bool IsFileInUse(string fileName){//判断文件是否使用中 

	bool inUse = true; 

	if (File.Exists(fileName)){ 

	FileStream fs = null; 

	try{fs = new FileStream(fileName, FileMode.Open, FileAccess.Read,FileShare.None);inUse = false;} 

	catch{}finally{if (fs != null)fs.Close();} 

	return inUse; 

	}else{return false;} 

	} 

	private void notifyIcon1_MouseDoubleClick(object sender, MouseEventArgs e) 

	{ 

	this.Visible = true; 

	this.WindowState = FormWindowState.Normal; 

	this.ShowInTaskbar = true; 

	} 

	private void Form1_Resize(object sender, EventArgs e) 

	{ 

	if (this.WindowState == FormWindowState.Minimized){ 

	this.ShowInTaskbar = false; 

	this.Visible = false; 

	} 

	} 

	private void 退出系统ToolStripMenuItem_Click_1(object sender, EventArgs e){ 

	Application.Exit(); 

	} 

	private void 显示窗口ToolStripMenuItem_Click(object sender, EventArgs e){ 

	this.Visible = true; 

	this.WindowState = FormWindowState.Normal; 

	this.ShowInTaskbar = true; 

	} 

	private void Form1_FormClosing(object sender, FormClosingEventArgs e){ 

	this.ShowInTaskbar = false; 

	this.Visible = false; 

	e.Cancel = true; 

	} 

	} 

	}