Most trojaning, spyware and keylogger tools have the ability to take screenshots. Is there a way to detect if an app or software is taking a screenshot in Windows? Maybe a Windows API call or dll?
This would be helpful for finding malware.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
My answer would require writing some code. I'm only posting this answer because you mentioned a programming related solution in your question.
Ever since Window Vista, the windows kernel raises an event for basically every single thing that happens on your computer. Microsoft provides a library called TraceEvent for .NET that makes it absolutely trivial to hook into these events.
For detecting a screenshot, you could monitor memory write events, file write events and so on. You can also hook into notifications for socket IO and the like. You can do all of this in around 30 lines of code.
From there, depending on how invasive and thorough you want to be, you could do a number of things. You could hook calls in the unknown processes such as Winsock's
send function, and wind up scraping a copy of all data that the process writes to a socket, and check it. You could look for a JPEG or PNG header in scraped data and fire off the alarm bells if you find one. You could open and analyze files it writes, etc.
It's at this point that things can get complicated, but you could probably hook the
send function with a library like EasyHook with a hundred or so LOC.
Another approach would be look at what libraries/WinAPI functions such an application would need to load to perform this function. You can detect when a process starts and when it loads an assembly (.dll) with these kernel events, so you could just look for the right (or wrong) combination of loaded assemblies. You could automatically hook WinAPI or OpenGL or DirectX functions that provide screen capture capability in every process that starts up, and directly monitor when applications access these capabilities.
For more information about this general approach you can see my other answer here.
I'd like to make it clear that the only thing I'm advertising as being easy is the process of hooking right into the heart of the OS and getting notifications about things happening. The art of correctly using this data to effectively catch malicious code is a much, much more difficult task.
You can detect it by monitoring free space (very easy) or file writes (not that easy). The screenshots must be stored somewhere so files will have to stack up to a not-so-obvious location.
This is the method I used, and I managed to locate and eliminate a multi-logger just by using a simple file manager.