87owo/PYAS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
PYDT authored and GitHub committed 2023-10-03 11:42:22 +08:00
1 parent ac14acd042
commit e33777c961
1 file changed
+7 -18
Download Patch File Download Diff File Expand all files Collapse all files
PYAS.py
+7 -18
View File
@@ -1136,18 +1136,17 @@ class MainWindow_Controller(QMainWindow):
if p.pid not in existing_processes:
existing_processes.add(p.pid)
name, file, cmd = p.name(), p.exe().replace("\\", "/"), p.cmdline()
if ":/Windows" in file:
if ":/Windows" in file or ":/Program" in file:
if "powershell" in name and self.api_scan(cmd[-1].split("'")[-2]):
p.kill()
self.send_notify(self.trans("惡意腳本攔截: ")+name)
elif "cmd.exe" in name and self.api_scan(" ".join(cmd[2:])):
p.kill()
self.send_notify(self.trans("惡意腳本攔截: ")+name)
elif self.scr_scan(cmd) or self.api_scan(cmd[-1]):
elif self.sign_scan(file) and self.api_scan(file):
p.kill()
self.send_notify(self.trans("惡意軟體攔截: ")+name)
elif ":/Program" in file:
if self.sign_scan(file) and self.api_scan(file):
elif self.scr_scan(cmd) or self.api_scan(cmd[-1]):
p.kill()
self.send_notify(self.trans("惡意軟體攔截: ")+name)
elif file != self.pyas and file not in self.whitelist:
@@ -1165,20 +1164,13 @@ class MainWindow_Controller(QMainWindow):
while self.file_protect:
for action, file in win32file.ReadDirectoryChangesW(hDir,1024,True,win32con.FILE_NOTIFY_CHANGE_FILE_NAME|win32con.FILE_NOTIFY_CHANGE_DIR_NAME|win32con.FILE_NOTIFY_CHANGE_ATTRIBUTES|win32con.FILE_NOTIFY_CHANGE_SIZE|win32con.FILE_NOTIFY_CHANGE_LAST_WRITE|win32con.FILE_NOTIFY_CHANGE_SECURITY,None,None):
try:
if action == 1 and str(f".{file.split('.')[-2]}").lower() in alist:
if action == 2 and str(f".{file.split('.')[-1]}").lower() in alist:
if self.ransom_block and self.sign_scan(self.proc.exe()):
self.proc.kill()
self.ransom_block = False
self.send_notify(self.trans("勒索軟體攔截: ")+self.proc.name())
elif "/AppData/" not in file:
self.ransom_block = True
elif action == 2 and str(f".{file.split('.')[-1]}").lower() in alist:
if self.ransom_block:
self.proc.kill()
self.ransom_block = False
self.send_notify(self.trans("勒索軟體攔截: ")+self.proc.name())
elif "/AppData/" not in file:
self.ransom_block = True
elif action == 3 and str(f".{file.split('.')[-1]}").lower() in slist:
file = str(f"C:/Users/{file}").replace("\\", "/")
if self.sign_scan(file) and self.api_scan(file):
@@ -1191,7 +1183,7 @@ class MainWindow_Controller(QMainWindow):
def protect_boot_thread(self):
while self.mbr_protect and self.mbr_value:
try:
time.sleep(0.2)
time.sleep(0.5)
with open(r"\\.\PhysicalDrive0", "r+b") as f:
if self.mbr_value[510:512] == b'\x55\xAA':
if f.read(512) != self.mbr_value:
@@ -1208,7 +1200,7 @@ class MainWindow_Controller(QMainWindow):
def protect_reg_thread(self):
while self.reg_protect:
try:
time.sleep(0.2)
time.sleep(0.5)
self.repair_system_image()
self.repair_system_restrict()
self.repair_system_file_type()
@@ -1219,15 +1211,12 @@ class MainWindow_Controller(QMainWindow):
def protect_net_thread(self):
while self.net_protect:
try:
time.sleep(0.2)
time.sleep(0.5)
for conn in self.proc.connections():
local_ip = socket.gethostbyname(socket.gethostname())
if local_ip == conn.laddr.ip and self.sign_scan(self.proc.exe()):
self.proc.kill()
self.send_notify(self.trans("網路通訊攔截: ")+self.proc.name())
if conn.status == "ESTABLISHED" and self.sign_scan(self.proc.exe()):
self.proc.kill()
self.send_notify(self.trans("網路通訊攔截: ")+self.proc.name())
except:
pass