From 560eb924b802ad50bb0515527e97f85bd9d18b60 Mon Sep 17 00:00:00 2001
From: PYDT <85057800+87owo@users.noreply.github.com>
Date: Tue, 21 Nov 2023 20:48:57 +0800
Subject: [PATCH] Add files via upload

---
 PYAS.py | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/PYAS.py b/PYAS.py
index 7fc42b9..54bbacc 100644
--- a/PYAS.py
+++ b/PYAS.py
@@ -1183,11 +1183,11 @@ class MainWindow_Controller(QMainWindow):
             time.sleep(0.05)
             for p in psutil.process_iter():
                 try:
-                    if p.pid not in existing_processes:
+                    name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
+                    if p.pid not in existing_processes and file not in self.whitelist:
                         existing_processes.add(p.pid)
                         psutil.Process(p.pid).suspend()
-                        name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
-                        if file != self.pyas and file not in self.whitelist:
+                        if ":/Windows" in file or ":/Program" in file:
                             if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
                                 p.kill()
                                 self.send_notify(self.trans("惡意腳本攔截: ")+file)
@@ -1197,15 +1197,14 @@ class MainWindow_Controller(QMainWindow):
                             elif ":/Windows" in file and self.api_scan(cmd[-1]):
                                 p.kill()
                                 self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif ":/Program" in file or "/AppData/" in file:
-                                if self.sign_scan(file) and self.api_scan(file):
-                                    p.kill()
-                                    self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif self.api_scan(file) or self.pe_scan(file):
+                            elif self.sign_scan(file) and self.api_scan(file):
                                 p.kill()
                                 self.send_notify(self.trans("惡意軟體攔截: ")+file)
-                            elif self.sign_scan(file):
-                                self.proc = p
+                        elif self.api_scan(file) or self.pe_scan(file):
+                            p.kill()
+                            self.send_notify(self.trans("惡意軟體攔截: ")+file)
+                        elif file != self.pyas and self.sign_scan(file):
+                            self.proc = p
                         psutil.Process(p.pid).resume()
                         gc.collect()
                 except: