Question

I’ve been trying to figure out how to detect this for months without any real progress. Whatever road I’ll try out testing C++/C# code, all turns out to be dead ends.

The problem:
I have two computers, Comp1 and Comp2. The first is remotely administered by Comp2 (via local network).
Now, on Comp1 i want to be able to detect if Comp2 are running code that are screen scraping (specific c#/c++ functions), or taking screen shots of, this computer, via the remote administration window on that machine.

Is this impossible? (if infecting Comp2 with some sort of trojan or virus is out of the question – which it definitely is!)

I can relatively easy get detailed information about the state of the remote administration itself (if being administered or not at this time) as well as other stuff (like IP administering) but not detect exactly what I want.

My next step is to see what the .dll files (the remote software are using) can tell me. My knowledge here is somewhat limited however.
What information could I get by hooking the “video driver” that was installed and is being used by the remote administration software? Is that another dead end?

Another thing that struck me would be to monitor the actual data traffic on specific ports (relevant to the current remote software), but that should fail as well because only data of what’s being sent to Comp2, or mouse/keyboard emulation being sent from the same, can be obtained (?)

I’d appreciate all ideas, suggestions or points to library entries (i.e MSDN).

Thanks in advance

Answer 1

I am not entirely sure i understand your question – but i will try to answer it anyway:

First let me rephrase the question the way i understand it:

Is there some way Host for a remote session can detect snapshots/screen scaraping done by the Client software running?

The short answer is “No”.

A simple analog would be to consider a camera pointed at the client machine. this camera directly records the monitor on the client machine – there is no way (unless the camera chooses to report to you by some custom interface) that you can know this is happening.

The same holds for the screen scraping software.
Screen scraping software records whatever goes on in a given machine.
The fact that some other machine is being viewed by the scraping software is not transmitted to the Host (Unless you designed the scraping software to do exactly that).

The only information that goes back to the host is what the client chooses to transmit.
Typically this is just the keyboard/mouse operations when the window showing the host is active.