c# 监控服务器上传木马(包含可疑文件)

using System;
using System.IO;
using System.Threading;
using System.Windows.Forms;
using System.Net;

namespace TrojanMonitor
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }
        delegate void SetTextCallback(string text);
        private string fname,code,emailkey,ip;
        private Thread thr;

        private void fsw_Changed(object sender, FileSystemEventArgs e)
        {//文件改动监控（包含了新增）
            fname = e.Name;
            thr = new Thread(new ThreadStart(chkfile));
            thr.IsBackground = true;
            thr.Start();
        }
        private void fsw_Renamed(object sender, RenamedEventArgs e)
        {//重命名监控
            fname = e.Name;
            thr = new Thread(new ThreadStart(chkfile));
            thr.IsBackground = true;
            thr.Start();
        }

        private void chkfile(){
            string filename = fname;
           string content="",filepath=fsw.Path+@"\"+filename,fileName="",hzhui="";
            
          fileName = Path.GetFileName(filename);
          hzhui = Path.GetExtension(filename).ToLower();
          if (hzhui == ".asp" || hzhui == ".aspx" || hzhui == ".php" || hzhui == ".jpg" || hzhui == ".gif")
          {
              try{
              if (IsFileInUse(filename)) { System.Threading.Thread.Sleep(2000); chkfile(); }
              StreamReader sr = new StreamReader(filepath);
              content = sr.ReadToEnd();
              sr.Close();             
              if (chkcontent(content)){
                  try{
                  string bakpath = Application.StartupPath + @"\TrojanMonitorbak", 
                      logfile = bakpath + @"\log" + DateTime.Today.ToShortDateString() + ".dat",
                    newfile = bakpath + @"\" + DateTime.Today.ToShortDateString() + @"\",
                    newfilepath = newfile + DateTime.Now.Hour.ToString() + "点" + DateTime.Now.Minute.ToString() + "分" + DateTime.Now.Second.ToString() + "秒" + DateTime.Now.Millisecond.ToString() + "毫秒-" + fileName;

                  if (!Directory.Exists(bakpath)) { Directory.CreateDirectory(bakpath); }
                  if (!Directory.Exists(newfile)) { Directory.CreateDirectory(newfile);}
                  if (File.Exists(newfilepath)){File.Delete(newfilepath);}

                  File.Move(filepath,newfilepath);
                      string str = "[" + DateTime.Now + "] 发现可疑文件: [" + filepath + "] To [" + newfilepath + "]";
                      addtiem(str);

                  StreamWriter sw = File.AppendText(logfile);
                  sw.WriteLine(str + " \r\n");//写入日志
                  sw.Flush();
                  sw.Close();
                  sw.Dispose();
                  downurl("http://www.cqeh.com/mail/?EmailSubject=发现可疑文件(" + ip + ")&EmailKey=" + emailkey + "&SendHtml=[" + ip + "][" + DateTime.Now + "] 发现可疑文件: [" + filepath + "]");//发送Email
                  sw = File.AppendText(filepath);
                  sw.WriteLine("此文件检测到有可疑问题！请联系管理员！");
                  sw.Flush();
                  sw.Close();
                  sw.Dispose();
              }
              catch (Exception ex) { addtiem(ex.ToString()); }
             }
            }
            catch (Exception ex) { addtiem(ex.ToString()); }
          }
        }

        private string downurl(string url){
            WebClient client = new WebClient();
            string result=client.DownloadString(url);
            return result;
        }

        private void addtiem(string text){
            if (this.lb.InvokeRequired){
                SetTextCallback d = new SetTextCallback(addtiem); 
                this.Invoke(d, new object[] { text }); 
            } else {
                this.lb.Items.Add(text); 
            }
        }
        private bool chkcontent(string content)
        {
            bool returnval = false;
            string[] sArray = code.ToLower().Split('|');
            content = content.ToLower();
            foreach (string i in sArray)
            {
                if (content.IndexOf(i)>-1){returnval=true;break;}
            }
            return returnval;
        }
        private void Form1_Load(object sender, EventArgs e){
            ip = Dns.GetHostEntry(Environment.MachineName).AddressList[0].ToString();
            string config = File.ReadAllText(Application.StartupPath + "//monitorpath.ini");//获取监控路径 d:\wwwroot
            try{
                code = downurl("http://www.cqeh.com/txt/trojan.txt");

　　　　　　　　　　//获取木马特征库
                filepath.Text = config;
                fsw.Path = config;
                emailkey = downurl("http://www.cqeh.com/txt/trojanemailkey.txt");

　　　　　　　　　　//获取发送email许可key;
                this.ShowInTaskbar=false;
                this.Visible = false;
            }
            catch (Exception ex){
                MessageBox.Show("错误：" + ex.Message, "无法启动程序!", MessageBoxButtons.OK); Application.Exit();
            }
            finally { }
            
        }
        bool IsFileInUse(string fileName){//判断文件是否使用中
            bool inUse = true;
            if (File.Exists(fileName)){
                FileStream fs = null;
                try{fs = new FileStream(fileName, FileMode.Open, FileAccess.Read,FileShare.None);inUse = false;}
                catch{}finally{if (fs != null)fs.Close();}
                return inUse;
            }else{return false;}
        }
        private void notifyIcon1_MouseDoubleClick(object sender, MouseEventArgs e)
        {
            this.Visible = true;
            this.WindowState = FormWindowState.Normal;
            this.ShowInTaskbar = true;
        }
        private void Form1_Resize(object sender, EventArgs e)
        {
            if (this.WindowState == FormWindowState.Minimized){
                this.ShowInTaskbar = false;
                this.Visible = false;
            }
        }
        private void 退出系统ToolStripMenuItem_Click_1(object sender, EventArgs e){
            Application.Exit();
        }
        private void 显示窗口ToolStripMenuItem_Click(object sender, EventArgs e){
            this.Visible = true;
            this.WindowState = FormWindowState.Normal;
            this.ShowInTaskbar = true;
        }
        private void Form1_FormClosing(object sender, FormClosingEventArgs e){
            this.ShowInTaskbar = false;
            this.Visible = false;
            e.Cancel = true;
        }
    }
}

源码包下载